Exams / DEA-C01 / Study guide / IAM for data pipelines

IAM for data pipelines: DEA-C01 study notes and practice questions

What to know about IAM for data pipelines for the DEA-C01 exam, from the Data Security and Governance domain (18% of the exam guide), then 1 free question to test it. Part of the DEA-C01 study guide.

Last verified October 2026 against current AWS documentation ·How we write our questions

What to know for the exam

IAM questions ask how to give a pipeline or user exactly the access it needs, often across accounts.

Roles for services

Glue jobs and crawlers run with an IAM role that needs S3, Data Catalog, KMS and CloudWatch Logs permissions.
EMR uses a service role and an EC2 instance profile (and runtime roles for per-job access).
Lambda uses an execution role.
Redshift uses roles attached to the cluster for COPY, UNLOAD, Spectrum and ML.
MWAA and Step Functions use execution roles to start other services.
Never put access keys in code or job parameters.

Policy evaluation

An explicit deny anywhere wins.
SCPs (organization), permissions boundaries and session policies limit what identity policies can grant.
Otherwise there must be an explicit allow from an identity or resource policy.
Cross-account access needs an allow on both sides: the caller’s identity policy and the resource’s policy (or an assumed role in the target account).

Tools for least privilege

IAM Access Analyzer finds resources shared outside the account and generates policies from CloudTrail activity.
Condition keys such as aws:SourceVpce, aws:PrincipalOrgID, s3:prefix and tags (ABAC).
IAM Identity Center for human users with permission sets.
S3 Access Points give each application its own policy on a shared bucket; S3 Access Grants map directory identities to prefixes.

Common traps

s3:* on * for a job that reads one prefix.
Cross-account with only one side allowed.
Forgetting KMS permissions for encrypted data.
IAM users with keys for applications instead of roles.

Try the 1 practice question

Practice IAM for data pipelines Take the free practice exam

Question 1

Medium ·Link to this question

A dental chain's AWS Glue job reads raw claim files from one S3 prefix and writes curated Parquet files to a second prefix. The raw data is encrypted with a customer managed KMS key. The job's execution role currently has AdministratorAccess because the first version of the pipeline needed it.

The security team wants the role reduced to only what the job needs. The CI/CD role that deploys the job must be able to pass the execution role to Glue, but nothing else.

Which change meets these requirements?

Choose one answer.

A. Keep AdministratorAccess on the execution role, and add an explicit deny on the CI/CD role for the iam:DeleteRole action.
B. Give the execution role s3:* on all buckets and kms:* on all keys, and let the CI/CD role use iam:PassRole on every role in the account.
C. Move the job's credentials into an IAM user with an access key stored in the job's script, so that the job no longer needs a role.
D. Scope the execution role to read the raw prefix, write the curated prefix and decrypt with one key, and let CI/CD pass only that role.

Show the answer and explanation

Answer: D

A. Wrong: An administrator role lets the job change any resource in the account, which is the risk the team wants removed. A deny on one action for the CI/CD role does not reduce the job's own permissions.
B. Wrong: Broad wildcards on every bucket and key are the opposite of least privilege. The option also lets the CI/CD role pass any role, which is more than the team allows.
C. Wrong: Long-lived access keys in a script are a credential-exposure risk, and the option does not reduce what the credentials can do. It conflicts with the team's security goals.
D. Right: Correct. Scoped S3 actions limit the job to its two prefixes, and kms:Decrypt on the one key covers the encrypted raw files. PassRole for the single execution role lets the CI/CD role deploy the job without gaining any other role. Learn more: Policies and permissions in AWS Identity and Access Management (opens in a new tab)

Explanation

Least privilege for a Glue job means scoping its S3 actions to the prefixes it reads and writes, and granting decrypt on only the key that protects the raw data. PassRole for the single execution role lets the deployment pipeline use that role without gaining any other permissions. Administrator access, wildcards and long-lived keys each break the least-privilege goal.

Study

Want more on IAM for data pipelines? The 5 full-length practice sets have 10 more IAM for data pipelines questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study IAM for data pipelines

Policies and permissions in AWS Identity and Access Management