AWS Certified Data Engineer Associate DEA-C01 Practice Question

Assuming an IAM role in account B provides temporary AWS Security Token Service (STS) credentials to the Glue job. Because the role is trusted by account A, the job can call STS to obtain short-lived keys whenever it runs, eliminating any need to embed or rotate long-term secrets. This is a role-based authentication mechanism. A pre-signed URL would require someone or some process to generate and inject the URL before each run. Storing permanent access keys in AWS Secrets Manager still relies on long-lived credentials that must be rotated. Amazon S3 does not support mutual TLS with customer-provided X.509 client certificates, so a certificate-based approach is not feasible.