DEA-C01 Practice Question 80: Trusted Identity Propagation Analytics
AWS Certified Data Engineer – Associate (DEA-C01) · Test 8 · question 10 of 10
Analysts use Amazon Quick dashboards to query data through Amazon Athena and Amazon Redshift. Today the dashboards connect with one shared IAM role, so data permissions apply to the role rather than to individual analysts, and audit logs cannot show who ran a query. Governance now requires that access is authorized by each analyst's corporate identity and group memberships, and that access logs name the individual. Which solution meets these requirements?
Show answer and explanation
Answer:
Trusted identity propagation *"enables administrators of AWS services to grant permissions based on user attributes such as group associations"*: *"identity context is added to an IAM role to identify the user requesting access to AWS resources"* and is propagated to other AWS services. Administrators can *"grant permissions to resources, such as data, using the corporate identities of your workforce"* and *"audit who accessed what data by looking at service logs or AWS CloudTrail"* (option C).
- A is wrong because long-lived IAM users and shared access keys are an insecure pattern, and keys held by Amazon Quick would still represent one identity rather than the analyst's corporate identity and groups. - B is wrong because a session tag added by the dashboard tool is not the analyst's identity as the analytics service verifies it, and permissions would still be evaluated for the shared role. - D is wrong because roles per group still make the role, not the individual, the identity in the service logs, and analysts choosing roles by hand weakens central control.
Reference: Trusted identity propagation overview