Departmental data is stored in S3 and queried from Athena, EMR, and Redshift Spectrum.
Manage table-, column-, and row-level access centrally.
Which configuration is most appropriate?
Combine Amazon S3 with AWS Lake Formation for cataloging, fine-grained permissions, and governed sharing.
Detailed explanation
Lake Formation centralizes catalog and fine-grained permissions over S3 data for analytics services.
Lake Formation centralizes catalog and fine-grained permissions over S3 data for analytics services.
Broad permissions do not provide fine-grained governance and violate least privilege.
Broad permissions do not provide fine-grained governance and violate least privilege.
SQS is a short-lived message queue, not a governed analytical data lake.
SQS is a short-lived message queue, not a governed analytical data lake.
Public access removes least privilege and cannot enforce departmental row or column boundaries.
Public access removes least privilege and cannot enforce departmental row or column boundaries.
Check official documentation
Compare the following points with the official documentation.
AWS Lake Formationのデータレイク権限、Glue Catalog、LF-Tags、クロスアカウント共有を確認する。
What to confirm
保存先・メッセージキュー・IAM広域権限と、データレイクガバナンスを区別できる。
Key points
- Lake Formation
- S3 data lake
- Fine-grained access
- Governance
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Policy layers
IAM, S3 policies, and Lake Formation grants must be designed together.
Least privilege
Grant each analyst and service only the datasets and fields required for its work.