AWS Certified Data Engineer Associate DEA-C01 Practice Question

EMR nodes obtain temporary credentials from the instance-profile role, so the role must include permission to write to the specific log bucket. Because the cluster is in a private subnet and must avoid public internet paths, traffic to Amazon S3 has to use a gateway VPC endpoint. Granting s3:PutObject permission to EMR_EC2_DefaultRole and creating the S3 gateway endpoint together provide the required authorization and a private network route. Retrieving long-term keys from Secrets Manager still violates best practices and adds operational risk. Allowing full S3 access and routing through an internet gateway exposes the subnet to the internet and breaks the privacy requirement. Enabling server-side encryption changes data-at-rest settings but does not address the missing permission or network path that caused AccessDenied.