CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Managing Cross-Account Data Access in AWS: A DEA-C01 Question Walkthrough
Understand how to effectively manage cross-account data access in AWS with our DEA-C01 exam question walkthrough.
Candidates often stumble on questions about managing cross-account data access. The nuances between governance policies and access controls can be confusing. Here, we break down a real exam question to clarify these concepts.
The question
A data engineer is tasked with ensuring that data shared between AWS accounts adheres to the company's governance policies. What is the most effective way to manage and monitor access to shared data across accounts?
A. Use AWS Organizations and Service Control Policies (SCPs)
B. Implement AWS CloudTrail and AWS Config across all accounts
C. Leverage Amazon S3 bucket policies and IAM roles for cross-account access
D. Utilize AWS Glue Data Catalog for data lineage tracking
Think before you scroll
Before choosing an answer, consider how AWS manages access to shared resources. Focus on the methods that allow for both access control and monitoring of shared data across accounts. This will guide you to the correct solution.
The answer
The correct option is C. Leverage Amazon S3 bucket policies and IAM roles for cross-account access. This method provides specific mechanisms for controlling and monitoring access to shared data, which is critical for adhering to governance policies.
Why the other options lose
A. Use AWS Organizations and Service Control Policies (SCPs)
While AWS Organizations and SCPs help manage permissions at an organizational level, they do not directly control access to specific data shared across accounts. They are more about governance at a higher level rather than data access.
B. Implement AWS CloudTrail and AWS Config across all accounts
CloudTrail and AWS Config are essential for auditing and compliance, but they do not provide direct mechanisms for controlling access to shared data. They track changes and access but do not influence the permissions themselves.
D. Utilize AWS Glue Data Catalog for data lineage tracking
AWS Glue Data Catalog is primarily focused on data discovery and lineage tracking, not on managing access controls. While it plays a role in understanding data movement, it does not enforce governance policies over shared data.
The concept behind it
The key principle here is that effective data governance requires both access control and monitoring. Amazon S3 bucket policies combined with IAM roles provide a clear way to enforce who can access what data, along with the ability to audit that access. Understanding how these components work together is essential for managing data across AWS accounts effectively.
Exam trap to remember
Always prioritize specific access control mechanisms for data management questions. Governance is important, but without direct access controls, you cannot effectively manage shared data.