Data Warehousing on AWS Training Data Warehousing on AWS: Security and Access Control 3 — Questions and Answers
Question 1: Which IAM policy condition key can restrict Redshift API calls to requests originating from specific IP addresses?
- aws:RequestedRegion
- aws:SourceIp (Correct answer)
- aws:PrincipalTag
- redshift:DbUser
Correct answer: aws:SourceIp
The aws:SourceIp condition key in IAM policies restricts API calls to those originating from specified IP address ranges.
Question 2: What is the security advantage of using IAM authentication with Amazon Redshift compared to database password authentication?
- IAM authentication provides faster query execution
- IAM credentials are temporary and automatically rotated, reducing the risk of credential compromise (Correct answer)
- IAM authentication bypasses VPC security controls
- IAM authentication eliminates the need for SSL/TLS encryption
Correct answer: IAM credentials are temporary and automatically rotated, reducing the risk of credential compromise
IAM authentication generates temporary credentials that expire automatically, eliminating long-lived passwords that could be compromised and reducing the attack surface.
Question 3: An AWS Glue job needs to read data from an encrypted Amazon Redshift cluster. What is the recommended way to store the Redshift credentials for the Glue job?
- Hardcode them in the Glue job script
- Store them in AWS Secrets Manager and reference them in the Glue connection (Correct answer)
- Store them in an S3 bucket with SSE-S3 encryption
- Pass them as environment variables in the Glue job parameters
Correct answer: Store them in AWS Secrets Manager and reference them in the Glue connection
AWS Secrets Manager is the recommended service for storing database credentials, and AWS Glue has native integration to retrieve secrets for data connections.
Question 4: Which Redshift cluster parameter controls whether SSL connections are required for all client connections?
- enable_user_activity_logging
- require_ssl (Correct answer)
- use_fips_ssl
- ssl_ca_path
Correct answer: require_ssl
The require_ssl cluster parameter, when set to true, forces all client connections to use SSL/TLS, rejecting non-encrypted connections.
Question 5: A data engineer wants to query data in S3 from Redshift Spectrum but must ensure only authorized S3 paths are accessible. Which approach enforces this?
- Configure S3 Transfer Acceleration on the bucket
- Use S3 bucket policies and IAM role permissions attached to the Redshift cluster (Correct answer)
- Enable Redshift Enhanced VPC Routing only
- Use Amazon Macie to scan and block unauthorized queries
Correct answer: Use S3 bucket policies and IAM role permissions attached to the Redshift cluster
S3 bucket policies combined with IAM role permissions on the Redshift cluster control which S3 paths and objects Spectrum queries can access.
Question 6: What is the effect of enabling 'Publicly Accessible' on an Amazon Redshift cluster?
- The cluster data is made public on the internet
- The cluster endpoint can be resolved from outside the VPC using a public IP (Correct answer)
- The cluster bypasses all security group rules
- The cluster's S3 data becomes publicly readable
Correct answer: The cluster endpoint can be resolved from outside the VPC using a public IP
Enabling 'Publicly Accessible' assigns the cluster a public IP address, allowing connections from outside the VPC, but security groups and authentication still control actual access.
Question 7: Which AWS service should be used to detect and alert on unusual query patterns or potential data exfiltration attempts in Amazon Redshift?
- Amazon Inspector
- Amazon GuardDuty (Correct answer)
- AWS Config
- Amazon Comprehend
Correct answer: Amazon GuardDuty
Amazon GuardDuty can analyze Redshift audit logs and CloudTrail events to detect anomalous behaviors, unusual queries, and potential data exfiltration attempts.
Data Warehousing on AWS Training Data Warehousing on AWS: Security and Access Control 3
Which IAM policy condition key can restrict Redshift API calls to requests originating from specific IP addresses?