Who should a Glue job authenticate as?
Why A is the answer
An IAM role with least privilege
Services use roles, with temporary credentials.
In detail
- A job should use an IAM role with least privilege.
- Roles give temporary credentials.
Use case
An illustrative scenario, not a real incident.
A Glue job runs as an IAM role with access only to its own buckets.
See it in different ways
flowchart LR A["Analyst role"] --> B["Lake Formation grants"] B --> C["Columns and rows allowed"] C --> D["Athena query results"]
mindmap
root((Data security))
Identity
IAM roles
Secrets Manager
Fine-grained access
Lake Formation
Column grants
Encryption
SSE-KMS
Discovery
Macie
Audit
CloudTrailflowchart LR S0["Create role"] --> S1["Grant least privilege"] --> S2["Assign to the job"]
Key point: Services authenticate with roles.
Why the other options are wrong
- B. The root user
- Root should not be used.
- C. A shared human password
- Human passwords should not run jobs.
- D. An access key in the script
- Keys should not be in scripts.