A Glue job accesses S3 and the Data Catalog.
Do not store an IAM user's long-term key in code or environment variables.
Which authentication approach is most appropriate?
Attach only the required S3 and Catalog permissions to a Glue service role and use temporary credentials.
Detailed explanation
A leak would have broad impact and rotation would be difficult.
A leak would have broad impact and rotation would be difficult.
A resource name is not an authentication credential and grants no access.
A resource name is not an authentication credential and grants no access.
Audit records cannot authenticate an AWS API request.
Audit records cannot authenticate an AWS API request.
The job receives temporary credentials at runtime without managing a long-term key.
The job receives temporary credentials at runtime without managing a long-term key.
Check official documentation
Compare the following points with the official documentation.
AWS IAM roles、Glue service role、temporary security credentialsの公式説明を確認する。
What to confirm
長期アクセスキーとサービスロールの認証リスクの違いを説明できる。
Key points
- IAM role
- Temporary credentials
- Trust policy
- Least privilege
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Authentication versus authorization
The trust policy identifies an allowed caller; the permissions policy defines its actions.
Review
Inspect unused permissions and CloudTrail activity and remove excess access.