Q2Data Operations and Support
A data engineer is configuring an AWS Glue job to read data from an Amazon S3 bucket. The data engineer has set up the necessary AWS Glue connection details and an associated IAM role. However, when the data engineer attempts to run the AWS Glue job, the data engineer receives an error message that indicates that there are problems with the Amazon S3 VPC gateway endpoint. The data engineer must resolve the error and connect the AWS Glue job to the S3 bucket. Which solution will meet this requirement?
← → navigate · a answer
Community votes
Discussion · 19
D 8
Selected Answer: D
A - wrong - AWS glue - is a serverless service, so it doesn't have any security groups
B - wrong - Because we have an error with VPC, not with S3 itself
C - wrong - Because with S3 - we always have only FQDN for buckets
D 4
Selected Answer: D
Although there is no such thing as "inbound and outbound routes" when we talk about a VPC route table, when we define an S3 gateway endpoint we must have proper routes in place. I will go with D.
D 2
Selected Answer: D
"problems with the Amazon S3 VPC gateway endpoint"
D 2
Selected Answer: D
D is the correct answer.
2
"route tables don´t have inbound and outbound routes."? They do. You need to check how VPC works in AWS.
D 2
Selected Answer: D
Be sure that the subnet configured for your AWS Glue connection has an Amazon S3 VPC gateway endpoint or a route to a NAT gateway in the subnet's route table.
1
Go with A:
If you get an error, check the following:
The correct privileges are provided to the selected role.
The correct Amazon S3 bucket is provided.
The security groups and Network ACL allow the required incoming and outgoing traffic.
The VPC you specified is connected to an Amazon S3 VPC endpoint.
1
I will go with D, the other options don't seem related.
C 1
Selected Answer: C
A - wrong - AWS glue doesn't have any security groups
B - wrong - You can´t give permissions in the S3 to the AWS glue job but to the role
D. wrong because there has to be a defined route for the S3 gateway endpoint in the subnet assigned to the glue job but not in the VPC's route table and also route tables doesn´t have inbound and outbound routes.
1
they most certainly can have SGs.
D 1
Selected Answer: D
I think D. We check "VPC's route table"
D 1
Selected Answer: D
D is correct
D 1
Selected Answer: D
D. Confirm that the VPC's route table includes inbound and outbound routes for the Amazon S3 VPC gateway endpoint.
Explanation:
AWS Glue jobs need to connect to the S3 bucket through the Amazon S3 VPC gateway endpoint when they are in a VPC. If the route table does not have the proper inbound and outbound routes to the S3 VPC gateway endpoint, the AWS Glue job will not be able to access S3, which leads to an error.
D 1
Selected Answer: D
A- NO: on SG we just need to allow outbound traffic, as SG is statefull return traffic is allowed
B - NO: since we configured IAM permission for Glue Job, there is no need to configure a resource-policy (cross account is not mentioned)
C - NO: in bucket connection configuration you just need to provide s3://bucket-name/prefix
D - YES: although there is no inbound and outbound routes in route table, we need to ensure a route is in place to reach the VPC Gateway Policy
B 1
Selected Answer: B
THought it needed an explicit security setting
D 1
Selected Answer: D
This makes sure the Glue job can access the S3 bucket through the VPC endpoint and fixes connectivity errors.
D 1
Selected Answer: D
D – Gateway endpoints work only if the route table has the S3 prefix list. If this is missing, it causes Glue connection failures.
D 1
Selected Answer: D
A - wrong - AWS glue - is a serverless service, so it doesn't have any security groups
B - wrong - Because we have an error with VPC, not with S3 itself
C - wrong - Because with S3 - we always have only FQDN for buckets
D 1
Selected Answer: D
A: wrong as glue imitates the reads from s3, second it is mentioned that it is a problem with the S3 Gateway endpoint
D: correct, exactly addresses the problem with the S3 VPC gateway endpoint