DEA-C01 practice question: Redshift users, roles and data sharing (2 of 2)
Data Security and Governance A free question from our original DEA-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.
A retail bank's risk team runs an Amazon Redshift RA3 cluster with transaction tables. The marketing team runs its own Redshift Serverless workgroup in a different AWS account and needs read-only access to two of those tables, always with the latest data.
The risk team does not want to give the marketing team admin access to its cluster, and it does not want nightly copies of the tables.
Which approach meets these requirements?
Choose one answer.
AA. Create an IAM user in the risk account for the marketing team, and give that user the Redshift admin role so that it can grant its own access.
BB. Unload the two tables to S3 every night, and let the marketing team load the files into its own workgroup with COPY.
CC. Create a datashare for the two tables, grant it to the marketing team's AWS account, and create a database from the share in its workgroup.
DD. Turn on public access for the risk cluster and give the marketing team its database password, so that it can connect over JDBC.
Show the answer and explanation
Answer: C
A. Wrong: An admin role gives the marketing team control over the risk cluster, which the risk team has ruled out. The option grants much more than read-only access to two tables.
B. Wrong: The nightly unload and load create copies that are a day old by the time marketing uses them. The option does not give the latest data and adds a process to maintain.
C. Right: Correct. Data sharing gives the consumer live, read-only access to the shared tables without copying them, and the producer decides which tables are in the share. After the marketing account accepts the share, it creates a database from it, and no admin role on the risk cluster is needed. Learn more: Data sharing in Amazon Redshift (opens in a new tab)
D. Wrong: Public access exposes the cluster to the internet and shares a password, which is unsafe for transaction data. The option fails the security requirements.
Explanation
Redshift data sharing lets a producer share selected tables live with a consumer namespace in another account, so the consumer reads current data without copies or admin access. The producer controls what is shared. Admin roles, nightly copies and public access each give too much access or too stale data.
Want more on Redshift users, roles and data sharing? The 5 full-length practice sets have 9 more Redshift users, roles and data sharing questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →