Configuring Redshift IAM Roles for Glue UNLOAD

DEA-C01 By islever Editorial Last updated

Perform data ingestion. Transform and process data.

Short answer

A Create an IAM role with S3 write permissions and associate it with the Amazon Redshift cluster to authorize the UNLOAD operation initiated by the Glue job.

Question

A company uses an Amazon Redshift cluster to manage data, including vendor sales data. The company wants to store a copy of the vendor data in an Amazon S3 bucket.
A data engineer sets up an AWS Glue job to upload the data to the S3 bucket data on a schedule. The data engineer set up a network connection to allow private traffic between Amazon Redshift and Amazon S3.
What is the next step required to meet this requirement?
  1. Create an IAM role that has permission to write to the S3 bucket. Associate the IAM role with the Amazon Redshift cluster. Correct Answer
  2. Add the S3 bucket to an AWS Glue Data Catalog. Configure Amazon Redshift Spectrum to access the Data Catalog.
  3. Enable the Amazon Redshift data sharing feature. Set the S3 bucket as a target bucket for data sharing.
  4. Store login credentials for Amazon Redshift in AWS Secrets Manager. Add a reference to the secret to the Glue job configuration.

Key Takeaways

The presence of a private network connection between Redshift and S3 indicates Redshift is unloading data directly to S3, meaning Redshift requires the S3 IAM role, not just the Glue job.

AWS Glue reads from Amazon Redshift by issuing an UNLOAD command to S3, requiring the Redshift cluster to have an IAM role with permissions to write to the S3 bucket.

Common mistake: Choosing D (Secrets Manager) because Glue needs Redshift credentials, overlooking that the Redshift-to-S3 network path proves Redshift itself is writing to S3 and needs an IAM role.

Expert Analysis

Redshift-to-S3 Data Movement

The critical detail in this scenario is the network connection established to allow private traffic between Amazon Redshift and Amazon S3. If the AWS Glue job were simply extracting data via JDBC and writing to S3 itself, a private network path between Redshift and S3 would be completely unnecessary; the traffic would flow from Glue to Redshift, and Glue to S3.

Glue's Underlying Mechanism

When AWS Glue reads from a Redshift source using a dynamic frame, it does not pull data over JDBC row-by-row. Instead, it leverages Redshift's UNLOAD command to export the data to an S3 bucket, and then Glue reads that data from S3. Because Redshift executes the UNLOAD command, Redshift must have direct network connectivity to S3 (which the engineer just configured) and the IAM permissions to write to the target S3 bucket.

Evaluating Option A

Creating an IAM role with S3 write permissions and associating it with the Amazon Redshift cluster fulfills the authorization requirement for the UNLOAD operation initiated by the Glue job. Option A is the correct next step.

Evaluating the Trap (Option D)

Option D sounds highly plausible because Glue jobs absolutely require Redshift credentials (typically stored in AWS Secrets Manager) to connect and orchestrate the read. However, providing credentials alone does not explain or utilize the newly established private network path between Redshift and S3. Without Option A, Redshift cannot authorize the UNLOAD to the target bucket, causing the Glue job to fail despite having valid login credentials.

Official Reference

https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-connect.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question mentions establishing a network connection between a source data store (like Redshift) and a target (like S3) for an orchestration job, recognize that the source is communicating directly with the target. Focus on granting the source the necessary IAM roles to perform the direct data transfer, rather than just configuring the orchestrator's credentials.

Community Votes

A
83%
D
17%

83% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 2 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 2

  1. Max1948 👍 1 Answered D
    • A is incorrect: Associating an IAM role with the Amazon Redshift cluster allows Redshift itself to read/write to S3 directly (such as via an UNLOAD or COPY command). However, the scenario specifies that an AWS Glue job is performing the scheduled data upload, meaning the connection authentication needs to be configured at the Glue layer, not the Redshift cluster layer.
  2. 9f871d2 👍 1 Answered A
    After setting Up GLUE job, IAM role has to be added to get data from redshift to S3 bucket.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Amazon Redshift Compound Sort Key Query Optimization

S-grade

Secure Redshift Spectrum Access with VPC Endpoints

S-grade

Athena Federated Query for Multi-Source Iceberg Pipelines

S-grade

Reclaiming Storage in Amazon Redshift Materialized Views

S-grade

Practice All DEA-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DEA-C01 Practice Test →

← Back to DEA-C01 Study Guide