DEA-C01 · Question #167
A company implements a data mesh that has a central governance account. The company needs to catalog all data in the governance account. The governance account uses AWS Lake Formation to centrally…
The correct answer is B. Create an Amazon Redshift data share that includes the tables that need to be shared. D. Share the Amazon Redshift data share to the Lake Formation catalog in the governance account. To centrally govern and share Amazon Redshift Serverless tables with varying column-level access requirements across different teams, the data engineer must first create an Amazon Redshift data share. This data share then needs to be integrated with AWS Lake Formation in the…
Question
A company implements a data mesh that has a central governance account. The company needs to catalog all data in the governance account. The governance account uses AWS Lake Formation to centrally share data and grant access permissions. The company has created a new data product that includes a group of Amazon Redshift Serverless tables. A data engineer needs to share the data product with a marketing team. The marketing team must have access to only a subset of columns. The data engineer needs to share the same data product with a compliance team. The compliance team must have access to a different subset of columns than the marketing team needs access to. Which combination of steps should the data engineer take to meet these requirements? (Choose two.)
Options
- ACreate views of the tables that need to be shared. Include only the required columns.
- BCreate an Amazon Redshift data share that includes the tables that need to be shared.
- CCreate an Amazon Redshift managed VPC endpoint in the marketing team's account. Grant the
- DShare the Amazon Redshift data share to the Lake Formation catalog in the governance account.
- EShare the Amazon Redshift data share to the Amazon Redshift Serverless workgroup in the
How the community answered
(30 responses)- A7% (2)
- B73% (22)
- C3% (1)
- E17% (5)
Why each option
To centrally govern and share Amazon Redshift Serverless tables with varying column-level access requirements across different teams, the data engineer must first create an Amazon Redshift data share. This data share then needs to be integrated with AWS Lake Formation in the governance account for centralized permission management and fine-grained access control.
While views can offer column-level control, integrating the Redshift data share with Lake Formation (D) provides a more robust and centrally governed mechanism for dynamic, fine-grained access across multiple teams and varying column subsets.
Creating an Amazon Redshift data share is the foundational step to group database objects like tables and views from a producer Redshift Serverless workgroup that are intended to be shared with other Redshift clusters or workgroups.
Amazon Redshift managed VPC endpoints are used to establish private network connectivity to Redshift, not for managing data sharing or access permissions across different accounts or teams.
Sharing the Amazon Redshift data share with the Lake Formation catalog in the governance account allows Lake Formation to act as the central authority for managing permissions, enabling fine-grained access control including column-level access for different consumer teams.
Sharing the data share to a specific Redshift Serverless workgroup is part of the consumption process, but the requirement for central governance and fine-grained permissions through Lake Formation makes option D the necessary step for the producer side's integration.
Concept tested: Redshift data sharing with Lake Formation integration
Source: https://docs.aws.amazon.com/redshift/latest/dg/sharing-data-with-lake-formation.html
Topics
Community Discussion
No community discussion yet for this question.