DEA-C01 · Question #291
A company runs a multi-tenant Amazon EMR cluster on Amazon EC2 instances. Multiple teams perform interactive query analyses and data transformations on the data in the EMR cluster. The teams can…
The correct answer is A. Set up runtime roles for EMR steps. Runtime roles for EMR steps allow each submitted step (such as a Spark job) to assume a distinct IAM role at execution time. By granting DynamoDB read permissions only to the role used by the authorized team’s steps, the confidential table data becomes accessible only to that…
Question
A company runs a multi-tenant Amazon EMR cluster on Amazon EC2 instances. Multiple teams perform interactive query analyses and data transformations on the data in the EMR cluster. The teams can access the cluster only through EMR Studio workspaces and EMR steps. The teams need to use EMR steps to run Apache Spark jobs to fetch data from an Amazon DynamoDB table. The DynamoDB table contains confidential data that must be accessible to only one specific team. The company needs to ensure that only the appropriate team can access the confidential data in the EMR cluster. Which solution will meet these requirements?
Options
- ASet up runtime roles for EMR steps.
- BSet up AWS Lake Formation permissions.
- CSet up IAM roles for EMR File System (EMRFS) requests.
- DSet up a DynamoDB resource-based policy.
How the community answered
(35 responses)- A80% (28)
- B11% (4)
- C3% (1)
- D6% (2)
Explanation
Runtime roles for EMR steps allow each submitted step (such as a Spark job) to assume a distinct IAM role at execution time. By granting DynamoDB read permissions only to the role used by the authorized team’s steps, the confidential table data becomes accessible only to that team’s Spark jobs, while other teams’ steps run with roles that lack access.
Topics
Community Discussion
No community discussion yet for this question.