A healthcare company is running an Amazon EMR cluster on Amazon EC2 instances to process data that is stored in Amazon S3. The company must ensure that the data processing jobs have access only to…

Question

Options

• ASet up security configurations in Amazon EMR, and set EnableApplicationScopedIAMRole to
• BSet up runtime roles to assume the EC2 instance profile of the Amazon EMR cluster.
• CSet up an EC2 instance profile for the Amazon EMR cluster to assume the runtime roles.
• DFor each IAM role that serves as an EMR runtime role, set up a trust policy with the EC2 instance
• EEstablish a trust policy between the EMR runtime roles and the EMR service role of the cluster.
• FSet up security configurations in Amazon EMR, and set EnableInTransitEncryption to true.

• A
  59% (32)
• B
  4% (2)
• E
  26% (14)
• F
  11% (6)

Explanation

Amazon EMR on EC2 supports "runtime roles (application-scoped IAM roles)" so each application/step assumes its own IAM role with least-privilege S3 access. You enable this via an EMR security configuration by setting "EnableApplicationScopedIAMRole = true." The EMR core/Task nodes run under the cluster's EC2 instance profile; therefore the instance profile must be permitted to "sts:AssumeRole" into the defined EMR runtime roles, and each runtime role must trust the instance profile (trust policy principal is the instance profile role). This design limits each job's S3 scope via role policies and enforces per-job access segregation. Option B reverses the trust (incorrect). Option E trusts the EMR service role (not used to assume runtime roles). Option F is unrelated (encryption in transit). The correct trio is to enable application-scoped roles (A), authorize the instance profile to assume them (C), and configure the runtime roles' trust relationship to allow that assumption (D).

No community discussion yet for this question.