AWS Certified Data Engineer Associate DEA-C01 Practice Question

A data engineering team runs AWS Glue Python shell jobs inside private subnets of a VPC that has no route to the internet. Each job must retrieve the target Amazon Redshift user password that is stored as an AWS Secrets Manager secret. According to AWS security best practices, how should the team configure authentication so the jobs can retrieve the secret without violating the principle of least privilege?

Attach an IAM role to each Glue job that allows only secretsmanager:GetSecretValue on the specific secret, and create an interface VPC endpoint for Secrets Manager so the job uses temporary role credentials inside the VPC.
Attach the AWS managed policy SecretsManagerReadWrite to the default AWSGlueServiceRole and use a NAT gateway so the subnet can reach Secrets Manager over the internet.
Encrypt the password with a customer-managed KMS key and pass it as an encrypted job parameter; the job decrypts it with the key at runtime.
Create an IAM user with long-lived access keys that can retrieve the secret and store the keys in the job's connection properties.

Report Issue

Answer Description

The recommended approach is to rely on role-based authentication and keep all traffic inside the VPC. By attaching an IAM role to each Glue job that grants only secretsmanager:GetSecretValue permission on the specific secret, the job receives temporary credentials automatically. Creating an interface VPC endpoint for Secrets Manager lets the jobs call the service without traversing the public internet. This satisfies the least-privilege principle and the requirement to avoid outbound internet access.

Passing the secret as an encrypted parameter still exposes secret material and bypasses Secrets Manager. Granting the broad SecretsManagerReadWrite managed policy plus a NAT gateway would work but violates least privilege and the no-internet rule. Storing long-lived access keys in connection properties contravenes IAM best practices and introduces credential-rotation complications.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.