AWS Certified Data Engineer Associate DEA-C01 Practice Question

An Amazon Redshift cluster runs in private subnets without a NAT gateway. The cluster must query only the objects in the s3://dept-finance/raw/ prefix by using Redshift Spectrum. A VPC interface endpoint (AWS PrivateLink) for Amazon S3 already exists in the subnets. Which action enforces this restriction while leaving other VPC workloads unaffected?

Replace the interface endpoint with an S3 gateway endpoint, associate it with the private subnets, and create a bucket policy that limits access to the raw/ prefix.
Modify the Redshift cluster's IAM role to allow s3:GetObject on dept-finance/raw/* and s3:ListBucket on the dept-finance bucket, leaving the endpoint configuration unchanged.
Add a bucket policy on the dept-finance bucket that allows GetObject only from the specified VPC endpoint and raw/ prefix while denying all other access paths.
Attach a custom IAM endpoint policy to the S3 interface VPC endpoint that permits s3:GetObject on arn:aws:s3:::dept-finance/raw/*, s3:ListBucket on arn:aws:s3:::dept-finance, and denies all other S3 actions.

Report Issue

Answer Description

Attaching a custom endpoint policy to the S3 interface endpoint restricts the actions that can be performed through that endpoint only. By allowing s3:GetObject and s3:ListBucket on arn:aws:s3:::dept-finance/raw/* and the bucket respectively, and denying other S3 permissions, the Redshift Spectrum query is limited to the required prefix. Redshift Spectrum requires both ListBucket and GetObject permissions to function. Other workloads that reach S3 through public endpoints or a different gateway are not affected because the endpoint policy is evaluated only when the interface endpoint is used. A bucket policy would impact every caller, changing the behavior for other workloads. Replacing the endpoint is unnecessary and costly. Changing only the Redshift role is a less secure option because the endpoint policy creates a network-level boundary that cannot be bypassed, even by a principal with overly permissive IAM credentials.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.