AWS Certified Data Engineer Associate DEA-C01 Practice Question

A data engineering team runs a Python ETL script on Amazon EC2 instances in a private subnet. The script must read objects from an S3 data lake and load the data into an Amazon Redshift cluster. Security policies forbid embedding any static access keys or passwords on the instances and require automatically rotated, short-lived credentials. Which authentication approach should the team use to meet these requirements with minimal operational overhead?

Attach an IAM role to the EC2 instance profile that grants access to Amazon S3 and Amazon Redshift, and let the script obtain temporary credentials from the instance metadata service.
Configure the script to connect to Amazon Redshift using a database username and password stored in AWS Systems Manager Parameter Store and grant the user SELECT and INSERT privileges.
Store an IAM user's access key and secret key in AWS Secrets Manager and retrieve them at runtime.
Generate X.509 client certificates for each EC2 instance and use certificate-based authentication when calling Amazon S3 and Amazon Redshift.

Report Issue

Answer Description

Using an IAM role attached to the EC2 instance profile provides temporary security credentials that are automatically rotated by AWS and delivered to the application through the instance metadata service. The SDK can retrieve these credentials without any hard-coded secrets, satisfying the requirement to avoid static passwords or access keys.

Retrieving long-lived IAM user keys from AWS Secrets Manager still requires managing and periodically rotating those keys, adding operational overhead. Storing a database username and password in Systems Manager Parameter Store protects the secret but still relies on static credentials and covers only Amazon Redshift, not S3. AWS does not support client X.509 certificate authentication for S3 or Amazon Redshift, so generating certificates would not meet the requirement.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.