Exam AWS Certified Data Engineer - Associate DEA-C01 topic 1 question 176 discussion

D & E S3 bucket policy is already updated from the question. Hence KMS key policy and IAM policy need to be altered to allow QuickSight service account to access KMS key.

Answer : DE

Correct answer B & D https://repost.aws/knowledge-center/quicksight-cross-account-s3 I want to use data from an Amazon Simple Storage Service (Amazon S3) bucket in another account to create a dataset in Amazon QuickSight. Short description Complete the following steps to create cross-account access from Amazon QuickSight (Account A) to an encrypted Amazon S3 bucket in another account (Account B): Update your S3 bucket policy in Account B where your S3 bucket resides. Add the S3 bucket as a resource that the QuickSight service role (Account A) can access. Allow the QuickSight service role access to the AWS Key Management Service (AWS KMS) key for the S3 bucket.

B & E. the issue isnt with sharing the bucket as the bucket policy does that already to the service role. its an encryption issue.

BD : B - To ensure QS has permissions to access the S3 D - To ensure QS has permission for KMS to decrypt date in S3

BD Conclusion: To enable cross-account access for both (1) the Amazon S3 bucket and (2) the KMS key used to encrypt that bucket, the QuickSight service role must be granted the appropriate permissions. Among the provided options, the following two steps are essential: B. Add the S3 bucket as a resource the QuickSight service role can access (→ Allows cross-account access to the S3 bucket) D. Add an IAM policy to the QuickSight service role that grants access to the KMS key (→ Allows decryption of data encrypted by the KMS key)

S3 bucket policy is already updated from the question. Hence KMS key policy and IAM policy need to be altered to allow QuickSight service account to access KMS key.

Given that the question states “Update the S3 bucket policy to allow access for the QuickSight service role” and, from the perspective of “enabling cross-account access so that QuickSight can interact with the S3 bucket,” is asking what additional steps are needed, we can conclude that: (B) “Add the S3 bucket as a resource accessible by the QuickSight service role” (E) “Add the KMS key as a resource accessible by the QuickSight service role” together most succinctly represent the final actions required.

B for bucket access E for KMS key policy

It is BD

Correct Answer: DE

Answer BE: Step to enable cross-account access: 1. update S3 bucket policy in Hub-account (B) 2. Update the KMS key Policy in Hub-Account(E) 3. Config QuickSight to access S3

Answer: BD

Answer:BE