Exam AWS Certified Machine Learning - Specialty topic 1 question 117 discussion

ASK : Extract Data over IPsec So we need an ETL + Site to site VPN GLUE is an ETL service but can it connect to PostgreSQL? yes https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-connect.html#aws-glue-programming-etl-connect-jdbc How to connect Glue to an on-site DB https://aws.amazon.com/blogs/big-data/how-to-access-and-analyze-on-premises-data-stores-using-aws-glue/ My Answer would be A Anser C only makes a 443 (SSL) connection so does not meet the IPsec requirement

A? IPSec needs to be covered as well

It's 'A' because IPSec is required.

A: https://medium.com/awsblackbelt/loading-on-prem-postgres-data-into-amazon-s3-with-server-side-filtering-c13bcee8b769

B - Doesnt take care of only nonsensitive data being allowed to leave the on-premise. C - Uses SSL and not IPSec. D - like B transfers all data. Hence the correct answer is A

I will go with B Site to Site VPN -> IPsec requirement AWS Glue -> connect and catalog PostgressSQL Pyspark -> remove sensitive information. AWS glue supports pyspark

The best option is to use AWS Database Migration Service (AWS DMS) with table mapping to select PostgreSQL tables with no sensitive data through an SSL connection. Replicate data directly intoAmazon S3. This option meets the following requirements:It ensures that only nonsensitive data is transferred to the cloud by using table mapping to filter outthe tables that contain sensitive data1.It uses IPsec to secure the data transfer by enabling SSL encryption for the AWS DMS endpoint2.It uploads the data to Amazon S3 each day for model retraining by using the ongoing replicationfeature of AWS DMS3

but glue can not filter out the data during the ingestion and hence option A wouldn't be the right one! I would go for B

B Both A and C are not correct... due that the question is not talking about tables with no sensitive data... and that DMS tipically act on the data on AWS side, the right answer is B AWS Glue connects to the PostgreSQL database, allowing the removal of sensitive data using a PySpark job BEFORE securely ingesting the data into Amazon S3, thus aligning with the requirements.

Option c

A: https://aws.amazon.com/blogs/big-data/doing-data-preparation-using-on-premises-postgresql-databases-with-aws-glue-databrew/

A. Create an AWS Glue job to connect to the PostgreSQL DB instance. Ingest tables without sensitive data through an AWS Site-to-Site VPN connection directly into Amazon S3. This solution meets the requirements of data localization regulations and secure data transfer. By creating an AWS Glue job to connect to the PostgreSQL DB instance, the machine learning specialist can extract tables without sensitive data. By using a Site-to-Site VPN connection, the data can be securely transferred from the on-premises data center to Amazon S3, where it can be used for model retraining. This solution ensures that any sensitive data remains in the on-premises data center, and that only non-sensitive data is uploaded to the cloud.

IPSec means VPN

Answer is A. IPsec is not the same as SSL. Site to site VPN is for IPsec: https://aws.amazon.com/vpn/site-to-site-vpn/ Also Glue can directly connect to Postgres and upload to S3: https://aws.amazon.com/blogs/big-data/how-to-access-and-analyze-on-premises-data-stores-using-aws-glue/

A is the answer

Between A and C, I pick A because IPSec requires VPN; otherwise DMS is a better option

Between A and C, I pick A because IPSec requires VPN; otherwise DMS is a better option