DEA-C01 Practice Question 90: Redshift Cross Account Role Chaining
AWS Certified Data Engineer – Associate (DEA-C01) · Test 9 · question 10 of 10
An Amazon Redshift cluster in account A must load data with COPY from an Amazon S3 bucket that belongs to account B. Security requires temporary credentials only, with no long-term access keys and no public access to the bucket. The data engineer created a role in account B that can read the bucket. Which approach completes the setup?
Show answer and explanation
Answer:
AWS describes cross-account access with chained IAM roles: *"each role in the chain assumes the next role in the chain, until the cluster assumes the role at the end of the chain."* Account A creates a Redshift service role (RoleA) that is attached to the cluster, and account B creates RoleB with access to the bucket. RoleA needs a permissions policy that allows it to assume RoleB, and RoleB needs a trust policy that allows RoleA. The COPY command then specifies both ARNs in its iam_role parameter, and RoleA temporarily assumes RoleB for the duration of the load (option B).
- A is wrong because a role can be associated with a cluster only if it is in the same account as the cluster, which is why role chaining exists for cross-account access. - C is wrong because it uses long-term access keys, which the security requirement forbids. - D is wrong because a public bucket exposes the data to everyone, which the requirement forbids.
Reference: Chaining IAM roles in Amazon Redshift