You are working as a machine learning specialist at a medical research facility. You have set up a data pipeline delivery stream using Amazon Kinesis Data Firehose as your data streaming service and Amazon Redshift as your data warehouse. Your researchers have set up the S3 bucket in their own account that you have used for your Kinesis Data Firehose. Your researchers need to access the data using BI tools such as Amazon QuickSight to build dashboards and use metrics in their research. However, when you implement your solution, you notice that your streaming data does not load into your Redshift data warehouse. What could be a reason why this is happening? Choose 2 answers.

Answer options:

A.You have not created an IAM role for your Kinesis Firehose to access the S3 bucket.
B.You defined a cluster security group and associated it with your Redshift cluster.
C.The access policy associated with your Kinesis Firehose does not have lambda:InvokeFunction specified in the Allow Action section of the Lambda actions.
D.The access policy associated with your Kinesis Firehose does not have kms:GenerateDataKey specified in the Allow Action section of the KMS actions.
E.The access policy associated with your Kinesis Firehose does not have S3:PutObjectAcl specified in the Allow Action section of the S3 actions.

Answers: A and E
Option A is correct. As documented in the Amazon Kinesis Data Firehose developer guide, “Kinesis Data Firehose uses the specified Amazon Redshift user name and password to access your cluster and uses an IAM role to access the specified bucket, key, CloudWatch log group, and streams. You are required to have an IAM role when creating a delivery stream.”
Option B is incorrect. The cluster security group is used to grant users inbound access to the Redshift cluster. Defining a cluster security group would not prevent Kinesis Firehose from accessing your Redshift cluster. (See the Amazon Redshift database developer guide titled Amazon Redshift Security Overview)
Option C is incorrect. Since you are not using the Lambda function feature of Kinesis Data Firehose, this Lambda action is not needed in the access policy.
Option D is incorrect. Since you are not using the data encryption feature of Kinesis Data Firehose, this KMS action is not needed in the access policy.
Option E is correct. Since you are not the owner of the S3 bucket used by Kinesis Data Firehose, you need to specify the S3:PutObjectAcl in the S3 actions of the access policy. (See the Amazon Kinesis Data Firehose developers guide titled Grant Kinesis Data Firehose Access to Amazon Redshift Destination)
Reference:
Please see the Amazon Kinesis Data Firehose developers guide titled Grant Kinesis Data Firehose Access to Amazon Redshift Destination, and the Amazon Kinesis Data Firehose overview page, and the Amazon Redshift database developer guide titled Amazon Redshift Security Overview.