AWS Certified Data Engineer Associate DEA-C01 Practice Question

A data engineering team owns a producer Amazon Redshift cluster in account A (us-east-1). Business analysts in account B need always-up-to-date read-only access to six tables that contain no PII. The solution must minimize data movement, prevent analysts from creating or modifying database objects, and follow the principle of least privilege. Which approach meets these requirements?

Configure VPC peering between the two clusters and create federated external tables in account B that reference the producer tables. Grant the analysts role permission to query the external tables.
On the producer cluster, create a datashare, add the six tables, and authorize account B. On the consumer cluster, create a database from the datashare, then grant USAGE on the database and SELECT on the shared tables to the analysts role.
Create a manual snapshot of the producer cluster, share the snapshot with account B, and have account B restore it to its own cluster. Grant the analysts role read-only access on the restored cluster.
Unload the six tables to an encrypted Amazon S3 bucket. Use AWS Lake Formation cross-account resource links to grant the analysts role SELECT access to the unloaded data.

Report Issue

Answer Description

Amazon Redshift Data Sharing lets a producer cluster create a datashare, add specific tables to it, and authorize consumer accounts or namespaces. The share is live, so data remains current without copying or unloading. By default the consumer can only read; it cannot create or modify objects in the producer cluster. On the consumer cluster, an administrator creates a database from the datashare, then explicitly grants USAGE on that database (and SELECT on the shared schema or tables) to the analysts role. This grants only the permissions required.

Sharing a manual snapshot would require restoring a separate cluster and keeping it synchronized, increasing cost and operational work. Unloading to Amazon S3 and using AWS Lake Formation copies the data and adds latency. VPC peering with federated queries between clusters is not a supported pattern for cross-account Redshift access and would still require credentials that allow object creation. Therefore, using Amazon Redshift Data Sharing with granular grants is the only solution that satisfies all stated requirements.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.