Get Your CertDEA-C01PlayCompete
‹ All DEA-C01 questions

DEA-C01 Practice Question 97: Glue JDBC Self Referencing Security Group

AWS Certified Data Engineer – Associate (DEA-C01) · Test 10 · question 7 of 10

Data Operations and Supportmedium

An AWS Glue ETL job uses a Glue connection to read from an Amazon RDS database in a private subnet. The job fails because it cannot connect to the database. The database's security group allows inbound traffic only on the database port from the application subnet, and the connection uses that same security group. Which change should the data engineer make to the security group?

Select one answer
Show answer and explanation

Answer:

  • D. Allow all TCP traffic from the security group to itself.

AWS documents that to let Glue components communicate when they access a data store in a VPC, you *"specify a security group with a self-referencing inbound rule for all TCP ports."* Such a rule restricts the source to the same security group, and *"a self-referencing rule will not open the VPC to all networks."* If outbound traffic is restricted, matching outbound rules are also needed (option D).

- A is wrong because opening the database port to the whole internet is unsafe, and it does not provide the self-referencing rule that Glue components need to talk to each other. - B is wrong because a NAT gateway provides outbound internet access. The connection to the database stays inside the VPC, so the missing rule is not an internet-routing problem. - C is wrong because a public address exposes the database to the internet and does not fix the Glue-to-Glue communication rule.

Reference: Setting up Amazon VPC for JDBC connections to Amazon RDS data stores from AWS Glue

Practice Test 10 ›

Study guides for DEA-C01

AWS Developer Associate exam guide: DVA-C02 to DVA-C03AWS Developer Associate exam: DVA-C02 ends 30 November 2026 and DVA-C03 starts 1 December. What changes, which to sit, format, price and study plan.
How AWS Certification Exams Work: Scoring and RenewalHow AWS certification exams work: levels, booking, question types, unscored questions, scaled scores, pass marks, validity and how recertification works.
What Is Amazon RDS? Multi-AZ, Read Replicas and BackupsWhat is Amazon RDS? Engines, Multi-AZ, read replicas, backups, RDS Proxy, Aurora and pricing explained, with the traps that AWS exams set around each one.
Microsoft Fabric certification: DP-700 vs DP-600Microsoft Fabric certification means two exams, DP-600 and DP-700. Their roles, skills, format, cost in India, and which one to take first.
Databricks Data Engineer Associate vs AWS DEA-C01Databricks Data Engineer Associate vs AWS Certified Data Engineer – Associate - format, cost, topics and which one to take for your job, as of 2026.
Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.
What Is AWS Glue? Data Catalog, Crawlers and ETL JobsWhat is AWS Glue? The Data Catalog, crawlers, ETL jobs and DPUs, workflows, streaming, job bookmarks, Flex and Data Quality, plus the traps AWS exams set.