DEA-C01 · Question #101
A company has a data lake on AWS. The data lake ingests sources of data from business units. The company uses Amazon Athena for queries. The storage layer is Amazon S3 with an AWS Glue Data Catalog…
The correct answer is A. Set up AWS Lake Formation. Define security policy-based rules for the users and applications by. AWS Lake Formation is the purpose-built service for fine-grained access control over data lakes backed by S3 and cataloged in AWS Glue. It supports column-level security (grant/revoke access to specific columns), row-level filtering, and tag-based access control, all enforced…
Question
A company has a data lake on AWS. The data lake ingests sources of data from business units. The company uses Amazon Athena for queries. The storage layer is Amazon S3 with an AWS Glue Data Catalog as a metadata repository. The company wants to make the data available to data scientists and business analysts. However, the company first needs to manage fine-grained, column-level data access for Athena based on the user roles and responsibilities. Which solution will meet these requirements?
Options
- ASet up AWS Lake Formation. Define security policy-based rules for the users and applications by
- BDefine an IAM resource-based policy for AWS Glue tables. Attach the same policy to IAM user
- CDefine an IAM identity-based policy for AWS Glue tables. Attach the same policy to IAM roles.
- DCreate a resource share in AWS Resource Access Manager (AWS RAM) to grant access to IAM
How the community answered
(24 responses)- A71% (17)
- B17% (4)
- C4% (1)
- D8% (2)
Explanation
AWS Lake Formation is the purpose-built service for fine-grained access control over data lakes backed by S3 and cataloged in AWS Glue. It supports column-level security (grant/revoke access to specific columns), row-level filtering, and tag-based access control, all enforced when users query data through Athena. Permissions are defined once in Lake Formation and applied to IAM users and roles. Option B (IAM resource-based policy on Glue tables) controls who can read table metadata, not which columns of the underlying data they can access. Option C (IAM identity-based policy on Glue) has the same limitation - it governs catalog API access, not column-level data filtering. Option D (AWS RAM) is for cross-account resource sharing, not fine-grained intra-account column access.
Topics
Community Discussion
No community discussion yet for this question.