Data Security and Governance · Topic 1 of 7
Authentication Mechanisms
Apply authentication for AWS data services with IAM roles, temporary credentials, Secrets Manager, Parameter Store, database sign in and VPC endpoints.
- 5 min
- Includes a diagram
- Roles give temporary credentials. Prefer roles to access keys for every service and workload.
- A trust policy defines who can assume a role. Permission policies define what it can do.
- Secrets Manager rotates secrets automatically. Parameter Store does not have built in rotation.
What it is
Authentication proves who or what is making a request. In a data platform the callers are people, applications, jobs and other AWS services, and each must prove its identity before it gets near data.
The AWS answer is to prefer short lived credentials from roles, keep secrets out of code, and limit which networks can reach data stores at all.
How it works
IAM identities
AWS Identity and Access Management (IAM) has users, groups and roles. A user has long term credentials such as a password or access keys.
A role has no permanent credentials. A caller assumes the role and receives temporary credentials from the AWS Security Token Service (STS).
For data pipelines, give each Glue job, Lambda function, EMR cluster and Step Functions state machine its own execution role. A role has a trust policy, which says who may assume it, and permission policies, which say what it may do.
| Caller | Authentication approach |
|---|---|
| Glue, Lambda, EMR, ECS tasks | Execution or instance role (no stored keys) |
| Engineer in the console or CLI | Federated sign in through IAM Identity Center or an identity provider, with MFA (multi factor authentication) |
| Application outside AWS | IAM Roles Anywhere, or a role assumed through STS |
| Another AWS account | Cross account role with a trust policy |
Avoid IAM users with access keys for workloads. Access keys can leak, and rotation is manual unless automated.
Secrets Manager and Parameter Store
Applications often need credentials for databases and APIs. Do not place them in code or environment files.
| Feature | AWS Secrets Manager | Systems Manager Parameter Store |
|---|---|---|
| Purpose | Secrets such as database passwords and API keys | Configuration values and secure strings |
| Rotation | Built in automatic rotation, with Lambda for supported databases | No built in rotation |
| Cost | Charged per secret | Standard parameters are free |
| Encryption | KMS (Key Management Service) | KMS for SecureString |
Choose Secrets Manager when rotation or cross account sharing is needed. Choose Parameter Store for simple, cheap configuration. Fetch secrets at run time and grant the role permission to read only the specific secret.
aws secretsmanager get-secret-value --secret-id prod/redshift/etl --query SecretString --output textDatabase authentication options
| Service | Options |
|---|---|
| Amazon RDS and Aurora | Database username and password, or IAM database authentication that uses a short lived token |
| Amazon Redshift | Database users and passwords, temporary credentials mapped from IAM, federated sign in, and the Data API with Secrets Manager or IAM |
| Amazon MSK | IAM access control, SASL/SCRAM with secrets in Secrets Manager, or mutual TLS (transport layer security) |
| Amazon OpenSearch Service | IAM signed requests, fine grained access control and SAML (Security Assertion Markup Language) sign in |
For Redshift, the Data API removes the need for an application to hold a connection or a driver. A Lambda function can call it using its role, and the role maps to temporary database credentials.
Glue connections and secrets
A Glue connection can point to a secret that holds JDBC credentials, so scripts never see the password. The same pattern works for EMR and Lambda: store the secret once, and give the execution role secretsmanager:GetSecretValue on it.
Network based authentication
Private networking shrinks the attack surface. Place data stores in private subnets, control traffic with security groups and network ACLs, and use VPC endpoints so traffic to AWS services stays on the AWS network.
- A gateway endpoint serves S3 and DynamoDB, adds a route table entry and has no hourly charge.
- An interface endpoint (AWS PrivateLink) serves most other services, using private IP addresses in your subnets.
Endpoint policies add a further check on what can be called through the endpoint. An S3 bucket policy can require requests to come from a given endpoint with the aws:sourceVpce condition key.
Cross account and federation
For access across accounts, create a role in the data account that trusts the other account, and have the caller assume it. For people, use IAM Identity Center or a corporate identity provider with SAML or OpenID Connect, and avoid creating separate IAM users.
What to remember for the exam
- Roles give temporary credentials. Prefer roles to access keys for every service and workload.
- A trust policy defines who can assume a role. Permission policies define what it can do.
- Secrets Manager rotates secrets automatically. Parameter Store does not have built in rotation.
- Never put credentials in code, scripts or templates.
- RDS and Aurora support IAM database authentication with short lived tokens.
- The Redshift Data API uses IAM or Secrets Manager and avoids managing connections.
- Gateway endpoints serve S3 and DynamoDB. Interface endpoints serve most other services.
- Use IAM Identity Center or federation for people, with MFA.
When a question asks to remove hardcoded database passwords with the least effort and automatic rotation, Secrets Manager is the answer.
Common mistakes
Embedding access keys in a script. Use the execution role of the job instead.
Confusing trust and permission policies. If a role cannot be assumed, fix the trust policy. If it is assumed but denied, fix the permissions.
Choosing Parameter Store when rotation is required. It stores secure strings but does not rotate them for you.
Sending data over the public internet. A job reaching S3 through a NAT gateway works, but a gateway endpoint keeps traffic private and avoids NAT charges.
A role that trusts an entire account lets any principal in that account with the right permissions assume it, so name the specific role in the trust policy when you can.
Check yourself
How should a Glue job get database credentials without storing them in code?
Read them from Secrets Manager using its execution role, usually through a Glue connection.
Which endpoint type serves S3 and DynamoDB?
A gateway endpoint.
What gives a workload temporary credentials?
An IAM role that the workload assumes through STS.
Topic 1 of 7 in Data Security and Governance
Test yourself on Data Security and Governance
The full AWS DEA-C01 question bank has 845 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.