DAS-C01 · Question #170
A company is providing analytics services to its sales and marketing departments. The departments can access the data only through their business intelligence (BI) tools, which run queries on Amazon…
The correct answer is B. Create an Amazon Redshift Spectrum IAM role with permissions for Lake Formation. Attach it to the D. Create an external schema in Amazon Redshift by using the Amazon Redshift Spectrum IAM role. E. Grant permissions in Lake Formation to allow the Amazon Redshift Spectrum role to access the three. To enable Amazon Redshift users to query S3 data lake tables managed by AWS Lake Formation with column-level security, a Redshift Spectrum IAM role is required, granted permissions by Lake Formation, and used in an external schema definition. This role, attached to the Redshift…
Question
A company is providing analytics services to its sales and marketing departments. The departments can access the data only through their business intelligence (BI) tools, which run queries on Amazon Redshift using an Amazon Redshift internal user to connect. Each department is assigned a user in the Amazon Redshift database with the permissions needed for that department. The marketing data analysts must be granted direct access to the advertising table, which is stored in Apache Parquet format in the marketing S3 bucket of the company data lake. The company data lake is managed by AWS Lake Formation. Finally, access must be limited to the three promotion columns in the table. Which combination of steps will meet these requirements? (Choose three.)
Options
- AGrant permissions in Amazon Redshift to allow the marketing Amazon Redshift user to access the three
- BCreate an Amazon Redshift Spectrum IAM role with permissions for Lake Formation. Attach it to the
- CCreate an Amazon Redshift Spectrum IAM role with permissions for the marketing S3 bucket. Attach it
- DCreate an external schema in Amazon Redshift by using the Amazon Redshift Spectrum IAM role.
- EGrant permissions in Lake Formation to allow the Amazon Redshift Spectrum role to access the three
- FGrant permissions in Lake Formation to allow the marketing IAM group to access the three promotion
How the community answered
(19 responses)- A21% (4)
- B68% (13)
- C5% (1)
- F5% (1)
Why each option
To enable Amazon Redshift users to query S3 data lake tables managed by AWS Lake Formation with column-level security, a Redshift Spectrum IAM role is required, granted permissions by Lake Formation, and used in an external schema definition. This role, attached to the Redshift cluster, is then granted granular access to specific columns in the advertising table through AWS Lake Formation permissions.
Granting permissions to the Amazon Redshift user for external tables is a final step within Redshift but does not control the underlying access from Redshift Spectrum to the S3 data lake via Lake Formation's column-level security.
Amazon Redshift Spectrum requires an IAM role to access data lake resources. This role must be granted permissions to interact with AWS Lake Formation, allowing Lake Formation to enforce its data access policies.
While the Redshift Spectrum role ultimately needs S3 access, with Lake Formation managing the data lake, the primary permission required by the Redshift Spectrum role is to interact with Lake Formation, which then mediates S3 access.
An external schema in Amazon Redshift is essential to define the connection to the AWS Glue Data Catalog, where the `advertising` table's metadata resides. This external schema must use the Amazon Redshift Spectrum IAM role to perform queries.
AWS Lake Formation is responsible for granular access control to the data lake. Granting permissions to the Amazon Redshift Spectrum role for specific columns in the `advertising` table within Lake Formation ensures that Redshift Spectrum can only access the permitted data fields.
Lake Formation permissions should be granted to the Amazon Redshift Spectrum IAM role that the cluster assumes for querying, not directly to an IAM group, as the BI tools connect via Redshift internal users.
Concept tested: Redshift Spectrum with Lake Formation security
Source: https://docs.aws.amazon.com/redshift/latest/dg/redshift-spectrum-external-schemas.html
Topics
Community Discussion
No community discussion yet for this question.