A Glue job in a processing account reads S3 in a data account.
Do not share access keys; only the intended role may be assumed.
Which authentication approach is most appropriate?
Create a role in the data account whose trust policy permits the processing principal and use AssumeRole for temporary access.
Detailed explanation
An audit service does not grant data access.
An audit service does not grant data access.
A long-lived maximum-privilege credential would create severe exposure.
A long-lived maximum-privilege credential would create severe exposure.
Trust and permissions are separated and temporary credentials are used.
Trust and permissions are separated and temporary credentials are used.
Unauthenticated readers could access confidential data.
Unauthenticated readers could access confidential data.
Check official documentation
Compare the following points with the official documentation.
AWS IAM AssumeRole、cross-account roles、S3 bucket policyの公式説明を確認する。
What to confirm
アクセスキー共有・公開と、AssumeRoleによる短期アクセスの違いを説明できる。
Key points
- AssumeRole
- Cross-account
- Trust policy
- S3 policy
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Two-sided permission
Cross-account access must be allowed by the caller and the resource-side policies.
Audit
Record the session identity and source account in CloudTrail.