AWS Certified Data Engineer - Associate DEA-C01Demo

By Amazon · Question Mode

QuestionQ321

Data Security and Governance

A company operates a multi-tenant Amazon EMR cluster on Amazon EC2 instances. Multiple teams conduct interactive query analysis and data transformations on data in the EMR cluster. The teams can access the cluster only by using EMR Studio workspaces and EMR steps.

The teams must use EMR steps to run Apache Spark jobs that retrieve data from an Amazon DynamoDB table. The DynamoDB table holds confidential data that must be available to only one particular team. The company must ensure that only the authorized team can access the confidential data in the EMR cluster.

Which solution meets these requirements?

  • A Set up runtime roles for EMR steps.
  • B Set up AWS Lake Formation permissions.
  • C Set up IAM roles for EMR File System (EMRFS) requests.
  • D Set up a DynamoDB resource-based policy.
Explanation

Amazon EMR runtime roles assign an IAM role to each submitted EMR step, so each Spark job can access only the AWS resources allowed by that role. Grant DynamoDB permissions for the confidential table only to the authorized team’s runtime role and restrict the other teams to roles without those permissions. This isolates step-level access on the shared EMR on EC2 cluster.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!