Securing AWS Glue Credentials with Secrets Manager

DEA-C01 By islever Editorial Last updated

Ensure data encryption and masking.

Short answer

DE Store credentials in AWS Secrets Manager and grant the AWS Glue job IAM role access to the stored credentials.

Question

During a security review, a company identified a vulnerability in an AWS Glue job. The company discovered that credentials to access an Amazon Redshift cluster were hard coded in the job script. A data engineer must remediate the security vulnerability in the AWS Glue job. The solution must securely store the credentials. Which combination of steps should the data engineer take to meet these requirements? (Choose two.)
  1. Store the credentials in the AWS Glue job parameters.
  2. Store the credentials in a configuration file that is in an Amazon S3 bucket.
  3. Access the credentials from a configuration file that is in an Amazon S3 bucket by using the AWS Glue job.
  4. Store the credentials in AWS Secrets Manager. Correct Answer
  5. Grant the AWS Glue job IAM role access to the stored credentials. Correct Answer

Key Takeaways

The question tests secure storage of secrets in AWS Glue, where the common trap is storing them in S3 or job parameters instead of a dedicated secrets service like Secrets Manager.

Learn how to remediate hardcoded credentials in AWS Glue jobs by using AWS Secrets Manager and IAM role permissions. This page establishes that D and E are the correct steps for secure credential management.

Common mistake: Learners often choose A (Glue Job Parameters) because it is a built-in feature, but it does not provide the same level of encryption and access control auditing as Secrets Manager, making it less secure for production environments.

Expert Analysis

Why the Answer Is Correct

Storing credentials in AWS Secrets Manager (D) is the industry best practice for managing sensitive data like database passwords, as it provides automatic rotation, encryption at rest, and fine-grained access policies. However, simply storing the secret is insufficient; the AWS Glue job must have permission to retrieve it. Therefore, granting the Glue job's execution IAM role access to the specific Secret ARN (E) is the necessary second step to enable the job to read the secret programmatically during runtime.

Why the Other Options Are Wrong

Option A (Glue Job Parameters) stores values in the job definition metadata, which can be exposed in logs or console views if not carefully managed, and lacks the lifecycle management of Secrets Manager. Option B and C involve storing credentials in an S3 bucket; while S3 supports encryption, hardcoding file paths and relying on bucket policies is more complex and prone to misconfiguration compared to the purpose-built Secrets Manager service.

Community Comment Notes

Community consensus strongly supports DE, with users noting that Secrets Manager is the 'best practice' for securing credentials. As GiorgioGss noted, you need both the storage service and the corresponding IAM permissions to access it. Another user confirmed that Ans DE is correct, reinforcing that both components are required for a complete solution.

Exam Strategy

When asked about securing credentials, always look for AWS Secrets Manager or Parameter Store. Remember that storage alone is never enough; you must also select the option that grants the consuming service (like Glue, Lambda, or EC2) the appropriate IAM permissions to access those secrets.

Frequently Asked Questions

Why not use AWS Glue Job Parameters?

Job parameters are stored in plaintext in the job definition unless encrypted, and they lack the audit trails and rotation capabilities of Secrets Manager.

Is S3 a good place to store Glue credentials?

No. While possible, it requires manual encryption key management and complex bucket policies. Secrets Manager is designed specifically for this use case.

More DEA-C01 FAQ →

Community Votes

DE
100%

100% of anonymous learners picked answer DE. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. GiorgioGss 👍 9
    D because it's AWS best practice for securing creds and E because after you put cred in secrets you will need permissions for accesing
  2. rralucard_ 👍 3
    D. Store the credentials in AWS Secrets Manager: AWS Secrets Manager is a service that helps you protect access to your applications, services, and IT resources without the upfront investment and on-going maintenance costs of operating your own infrastructure. It's specifically designed for storing and retrieving credentials securely, and therefore, it is an appropriate choice for handling the Redshift cluster credentials. E. Grant the AWS Glue job IAM role access to the stored credentials: IAM roles for AWS Glue will allow the job to assume a role with the necessary permissions to access the credentials in AWS Secrets Manager. This method avoids embedding credentials directly in the script or a configuration file and allows for centralized management of the credentials.
  3. damaldon 👍 1
    Ans, DE

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Amazon Redshift Compound Sort Key Query Optimization

S-grade

Secure Redshift Spectrum Access with VPC Endpoints

S-grade

Athena Federated Query for Multi-Source Iceberg Pipelines

S-grade

Reclaiming Storage in Amazon Redshift Materialized Views

S-grade

Practice All DEA-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DEA-C01 Practice Test →

← Back to DEA-C01 Study Guide