AIP-C01 · Question #77
A company uses AWS Lake Formation to set up a data lake that contains databases and tables for multiple business units across multiple AWS Regions. The company wants to use a foundation model (FM)…
The correct answer is B. Configure the FM to authenticate by using AWS Identity and Access Management roles and Lake. AWS Lake Formation supports column-level security, which allows specific PII columns to be excluded or redacted before data is served to a consumer - including a Bedrock FM operating under an IAM role. By granting the FM's IAM role only the Lake Formation permissions needed for…
Question
A company uses AWS Lake Formation to set up a data lake that contains databases and tables for multiple business units across multiple AWS Regions. The company wants to use a foundation model (FM) through Amazon Bedrock to perform fraud detection. The FM must ingest sensitive financial data from the data lake. The data includes some customer personally identifiable information (PII). The company must design an access control solution that prevents PII from appearing in a production environment. The FM must access only authorized data subsets that have PII redacted from specific data columns. The company must capture audit trails for all data access. Which solution will meet these requirements?
Options
- ACreate a separate dataset in a separate Amazon S3 bucket for each business unit and Region
- BConfigure the FM to authenticate by using AWS Identity and Access Management roles and Lake
- CUse direct IAM principal grants on specific databases and tables in Lake Formation. Create a
- DConfigure the FM to request temporary credentials from AWS Security Token Service. Access the
How the community answered
(23 responses)- A4% (1)
- B57% (13)
- C13% (3)
- D26% (6)
Explanation
AWS Lake Formation supports column-level security, which allows specific PII columns to be excluded or redacted before data is served to a consumer - including a Bedrock FM operating under an IAM role. By granting the FM's IAM role only the Lake Formation permissions needed for approved, non-PII data subsets, the solution enforces least-privilege access without duplicating data. AWS CloudTrail automatically captures all Lake Formation data access events, satisfying the audit trail requirement. Option A (separate S3 buckets per business unit and Region) does not provide column-level PII redaction and significantly increases management overhead. Option C (direct IAM grants on databases and tables) does not offer column-level filtering; you would need additional mechanisms to redact PII columns. Option D (STS temporary credentials) is a credential-vending mechanism, not an access control or PII-redaction strategy, and does not solve the column-level masking requirement.
Topics
Community Discussion
No community discussion yet for this question.