Three teams of data analysts use Apache Hive on an Amazon EMR cluster with the EMR File System (EMRFS) to query data stored within each teams Amazon S3 bucket. The EMR cluster has Kerberos enabled…

Question

Options

• AFor the EMR cluster Amazon EC2 instances, create a service role that grants no access to
• BFor the EMR cluster Amazon EC2 instances, create a service role that grants no access to
• CFor the EMR cluster Amazon EC2 instances, create a service role that grants full access to
• DFor the EMR cluster Amazon EC2 instances, create a service role that grants full access to

• A
  4% (2)
• B
  77% (43)
• C
  14% (8)
• D
  5% (3)

Explanation

The correct approach uses IAM roles for EMRFS (EMRFS Security Configuration) to implement per-user or per-group S3 access control. The EC2 service role for the cluster nodes is given no direct S3 access. Instead, EMRFS role mappings are configured so that when a Kerberos-authenticated user (mapped from Active Directory) accesses S3, EMRFS assumes a specific team-scoped IAM role that grants access only to that team's S3 bucket. This ensures that the Kerberos/AD identity drives fine-grained S3 authorization, satisfying the team-isolation requirement without granting blanket S3 access at the instance level.

No community discussion yet for this question.