Data Security and Governance A free question from our original DEA-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.
A dental chain's AWS Glue job reads raw claim files from one S3 prefix and writes curated Parquet files to a second prefix. The raw data is encrypted with a customer managed KMS key. The job's execution role currently has AdministratorAccess because the first version of the pipeline needed it.
The security team wants the role reduced to only what the job needs. The CI/CD role that deploys the job must be able to pass the execution role to Glue, but nothing else.
Which change meets these requirements?
Choose one answer.
AA. Keep AdministratorAccess on the execution role, and add an explicit deny on the CI/CD role for the iam:DeleteRole action.
BB. Give the execution role s3:* on all buckets and kms:* on all keys, and let the CI/CD role use iam:PassRole on every role in the account.
CC. Move the job's credentials into an IAM user with an access key stored in the job's script, so that the job no longer needs a role.
DD. Scope the execution role to read the raw prefix, write the curated prefix and decrypt with one key, and let CI/CD pass only that role.
Show the answer and explanation
Answer: D
A. Wrong: An administrator role lets the job change any resource in the account, which is the risk the team wants removed. A deny on one action for the CI/CD role does not reduce the job's own permissions.
B. Wrong: Broad wildcards on every bucket and key are the opposite of least privilege. The option also lets the CI/CD role pass any role, which is more than the team allows.
C. Wrong: Long-lived access keys in a script are a credential-exposure risk, and the option does not reduce what the credentials can do. It conflicts with the team's security goals.
Least privilege for a Glue job means scoping its S3 actions to the prefixes it reads and writes, and granting decrypt on only the key that protects the raw data. PassRole for the single execution role lets the deployment pipeline use that role without gaining any other permissions. Administrator access, wildcards and long-lived keys each break the least-privilege goal.
Want more on IAM for data pipelines? The 5 full-length practice sets have 10 more IAM for data pipelines questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →