Restricting AWS Glue Access by Prefix and Time with IAM
Short answer
B Use S3 object ARN patterns with wildcards in the Resource element and aws:CurrentTime with DateGreaterThan/DateLessThan in the Condition element.
Question
Which elements must the company include in a custom IAM policy to meet these requirements?
Key Takeaways
The main trap is confusing IAM condition keys (
s3:prefix) with resource patterns (*in ARN) and mistaking API Gateway variables ($util.time) for IAM time conditions.
Learn how to restrict AWS Glue jobs to specific S3 prefixes and business hours using IAM policies. The correct solution combines S3 ARN wildcards in the Resource element with aws:CurrentTime conditions.
Common mistake: Choosing C because `s3:prefix` seems like a direct filter, but it doesn't restrict access by itself without proper Resource scoping, and using `s3:ResourceAccount` (D) or API Gateway variables (A) are syntactic errors.
Expert Analysis
The scenario requires restricting AWS Glue jobs to specific S3 prefixes and limiting access to business hours. The core challenge lies in correctly applying IAM policy syntax for both resource-level restrictions and time-based conditions.
First, regarding the prefix restriction: While Option C suggests using s3:prefix in a Condition element, this is incorrect for controlling data access permissions. To restrict which objects (or folders) an IAM principal can access, you must use wildcards in the Resource element of the IAM policy statement. For example, arn:aws:s3:::bucket/prefix/*. Using s3:prefix in the Condition block only evaluates the request parameter but does not inherently deny access if the Resource pattern is too broad; however, the primary mechanism for enforcing "access only specific prefixes" is through the Resource ARN pattern. Comments confirm that Option B's approach of using Resource ARN patterns with wildcards is the standard method for folder-level navigation restrictions.
Second, regarding the time restriction: IAM policies support time-based conditions using the aws:CurrentTime condition key. The operators for date/time comparisons are DateGreaterThan, DateLessThan, DateEquals, etc. Option A incorrectly uses $util.time, which is a variable from Amazon API Gateway, not IAM. Option D uses s3:ResourceAccount, which is irrelevant to time or prefix restrictions.
Option B correctly combines these two elements: it uses S3 object ARN patterns with wildcards in the Resource element to define the scope of accessible prefixes, and it uses the aws:CurrentTime condition key with DateGreaterThan and DateLessThan operators to enforce the business hours constraint. Note: While s3:ListBucket actions also require prefix conditions, the question focuses on the general mechanism for restricting Glue job access to specific prefixes, making the Resource pattern + Time Condition the correct structural answer.
The confusion often arises between using s3:prefix in Conditions vs. wildcards in Resources. Wildcards in Resources are the direct enforcement mechanism for what data can be read/written.
Exam Strategy
When constructing IAM policies for S3, always remember that 'prefix' restrictions are primarily enforced via wildcards in the Resource ARN string (e.g., arn:aws:s3:::bucket/prefix/). Do not rely solely on s3:prefix in the Condition block unless specifically handling list operations or as a secondary check. For time-based access, always use aws:CurrentTime with Date operators, never service-specific variables like $util.time.
Frequently Asked Questions
Can I use s3:prefix in the Condition element to restrict Glue access?
s3:prefix in conditions, the primary way to restrict access to specific folders is by defining the allowed prefixes in the Resource ARN using wildcards. Conditions add additional checks but don't replace the need for proper Resource scoping.What is the difference between DateGreaterThan and DateGreaterThanEquals?
DateGreaterThan excludes the exact boundary time, while DateGreaterThanEquals includes it. For business hours (9 AM to 5 PM), you typically use DateGreaterThanOrEqualTo 09:00 and DateLessThan 17:00 to include 9 AM exactly and exclude 5 PM.Discussion 2 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 2
-
Max1948 👍 1 Answered COption B is incorrect because it fails to effectively restrict folder-level navigation (listing data) within Amazon S3. To safely limit folder-level discovery based on classification, you must use the s3:prefix condition key in the Condition block to evaluate the path parameter passed during the API call. Also Strict Boundary Errors with DateGreaterThan vs DateGreaterThanEquals
-
9f871d2 👍 1 Answered BTo restrict S3 access by folder/prefix → Use Resource element with ARN wildcards. $Util-Time is common distractor .It is not used in IAM policies.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All DEA-C01 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DEA-C01 Practice Test →