DAS-C01 · Question #66
A company is providing analytics services to its Marketing and Human Resources (HR) departments. The departments can only access the data through their business intelligence (BI) tools, which run…
The correct answer is A. Create separate IAM roles for the Marketing and HR users. Assign the roles with AWS Glue. When EMR uses the AWS Glue Data Catalog as its metastore, you can apply fine-grained IAM resource-level permissions on individual Glue databases and tables. By creating separate IAM roles for Marketing and HR with Glue resource policies scoped to their respective tables, Presto…
Question
A company is providing analytics services to its Marketing and Human Resources (HR) departments. The departments can only access the data through their business intelligence (BI) tools, which run Presto queries on an Amazon EMR cluster that uses the EMR File System (EMRFS). The Marketing Data Analyst must be granted access to the advertising table only. The HR Data Analyst must be granted access to the personnel table only. Which approach will satisfy these requirements?
Options
- ACreate separate IAM roles for the Marketing and HR users. Assign the roles with AWS Glue
- BCreate the Marketing and HR users in Apache Ranger. Create separate policies that allow access
- CCreate separate IAM roles for the Marketing and HR users. Configure EMR to use IAM roles for
- DCreate the Marketing and HR users in Apache Ranger. Create separate policies that allows
How the community answered
(15 responses)- A80% (12)
- B7% (1)
- C13% (2)
Explanation
When EMR uses the AWS Glue Data Catalog as its metastore, you can apply fine-grained IAM resource-level permissions on individual Glue databases and tables. By creating separate IAM roles for Marketing and HR with Glue resource policies scoped to their respective tables, Presto (which reads metadata from Glue) enforces table-level access. Apache Ranger (options B and D) also supports table-level policies for Presto on EMR, but requires deploying and managing Ranger, adding complexity. The IAM/Glue approach is the native AWS mechanism and aligns with the existing EMRFS setup described.
Topics
Community Discussion
No community discussion yet for this question.