Securing AWS Glue Credentials with Secrets Manager
During a security review, a company identified a vulnerability in an AWS Glue job. The company discovered that credentials to access an Amazon Redshift cluster were hard coded in the job script. A data engineer must remediate the security vulnerability in the AWS Glue job. The solution must securely store the credentials. Which combination of steps should the data engineer take to meet these requirements? (Choose two.)
Community Votes
100% of anonymous learners picked answer DE. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests secure storage of secrets in AWS Glue, where the common trap is storing them in S3 or job parameters instead of a dedicated secrets service like Secrets Manager.
Learn how to remediate hardcoded credentials in AWS Glue jobs by using AWS Secrets Manager and IAM role permissions. This page establishes that D and E are the correct steps for secure credential management.
Learners often choose A (Glue Job Parameters) because it is a built-in feature, but it does not provide the same level of encryption and access control auditing as Secrets Manager, making it less secure for production environments.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Storing credentials in AWS Secrets Manager (D) is the industry best practice for managing sensitive data like database passwords, as it provides automatic rotation, encryption at rest, and fine-grained access policies. However, simply storing the secret is insufficient; the AWS Glue job must have permission to retrieve it. Therefore, granting the Glue job's execution IAM role access to the specific Secret ARN (E) is the necessary second step to enable the job to read the secret programmatically during runtime.Why the Other Options Are Wrong
Option A (Glue Job Parameters) stores values in the job definition metadata, which can be exposed in logs or console views if not carefully managed, and lacks the lifecycle management of Secrets Manager. Option B and C involve storing credentials in an S3 bucket; while S3 supports encryption, hardcoding file paths and relying on bucket policies is more complex and prone to misconfiguration compared to the purpose-built Secrets Manager service.Community Comment Notes
Community consensus strongly supports DE, with users noting that Secrets Manager is the 'best practice' for securing credentials. As GiorgioGss noted, you need both the storage service and the corresponding IAM permissions to access it. Another user confirmed that Ans DE is correct, reinforcing that both components are required for a complete solution.Exam Strategy
When asked about securing credentials, always look for AWS Secrets Manager or Parameter Store. Remember that storage alone is never enough; you must also select the option that grants the consuming service (like Glue, Lambda, or EC2) the appropriate IAM permissions to access those secrets.
Frequently Asked Questions
Why not use AWS Glue Job Parameters?
Job parameters are stored in plaintext in the job definition unless encrypted, and they lack the audit trails and rotation capabilities of Secrets Manager.
Is S3 a good place to store Glue credentials?
No. While possible, it requires manual encryption key management and complex bucket policies. Secrets Manager is designed specifically for this use case.
Related Analysis
Practice All DEA-C01 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DEA-C01 Practice Test →