Exam AWS Certified Big Data - Specialty topic 1 question 37 discussion

Answer is D. One of the reasons for not going with A is, max number of IAM groups in an AWS account is 300. So, A is not scalable solution. If the company has more than 300 managers, A won't work.

All in all, option D is the correct answer "The second advantage of views is that you can assign a different set of permissions to the view. A user might be able to query the view, but not the underlying table. Creating the view excluding the sensitive columns (or rows) should be useful in this scenario." http://www.silota.com/blog/rethink-database-views-redshift/ "For example, the following command enables the user HR both to perform SELECT commands on the employees table and to grant and revoke the same privilege for other users. grant select on table employees to HR with grant option;" https://docs.aws.amazon.com/redshift/latest/dg/r_GRANT.html

D is probably the best option. A means creating a IAM user for each employee. While we have no details of the industry or the number of employees, in general that doesn't seem a great idea.

Answer : D – Not A – Lot of maintenance to create one group per manager. Not B – Cost overhead- cost will multiple manifold. Not C – Doesn’t make sense. How will RedShift talk to KMS? Who will manage the key-pair for each manager in KMS. D – is the correct answer because you can create view to provide row-level access based on the attribute values in the underlying table.

my selection D

D is the right choice. There is only one option for RLS (row-level security)

I would choose D over A since IAM access let you control access or deny at table level but not at records level as per my understanding.

D, using view you can restrict data that is being retrieved from Redshift. It is a common practice in traditional Relational DBs

I went with A

D is a common approach in this case. A should be incorrect since, e.j. Create view my_employees as select * from employees where manager = db_user_who_is_a _manager. Option A is incorrect as per its wording. You don’t create IAM groups for a manager with each employee as an IAM user in that group... This question is not related to security.

create as many groups to control access right, I don't hire pra276 even he has tons of Certs.

Whoever says D is answer. Please read about these https://www.intermix.io/blog/iam-to-generate-temporary-amazon-redshift-passwords/ https://docs.aws.amazon.com/redshift/latest/mgmt/generating-iam-credentials-steps.html

D, redshift view is allowed filter out the user base access