Analysts need column-level access to data lake tables, managed centrally. What do you use?
Why A is the answer
AWS Lake Formation permissions
Lake Formation provides central, fine-grained permissions, including column-level access.
In detail
- Lake Formation gives central, column-level access.
- It covers data lake tables centrally.
Use case
An illustrative scenario, not a real incident.
Analysts may read a table except its salary column. A Lake Formation permission grants that, in one central place.
See it in different ways
flowchart LR A["Analyst role"] --> B["Lake Formation grants"] B --> C["Columns and rows allowed"] C --> D["Athena query results"]
mindmap
root((Data security))
Identity
IAM roles
Secrets Manager
Fine-grained access
Lake Formation
Column grants
Encryption
SSE-KMS
Discovery
Macie
Audit
CloudTrailsequenceDiagram participant P0 as Analyst participant P1 as Query engine participant P2 as Lake Formation P0->>P1: Query table P1->>P2: Check permissions P2-->>P1: Allowed columns
Key point: Lake Formation gives central fine-grained access.
Why the other options are wrong
- B. S3 bucket policies per object
- Per-object policies are not column-level.
- C. Security groups
- Security groups control networks.
- D. A shared IAM user
- A shared user removes accountability.