An analyst reads the sales table in the Glue Data Catalog through Athena.
Do not grant access to the whole S3 bucket or other tables.
Which authorization approach is most appropriate?
Grant Lake Formation Table SELECT on the required table and align data-location, IAM, and Catalog settings.
Detailed explanation
Table-level authorization limits the analyst while preserving the registered data location.
Table-level authorization limits the analyst while preserving the registered data location.
The analyst could read objects outside the table boundary.
The analyst could read objects outside the table boundary.
Audit logs do not authorize a data read.
Audit logs do not authorize a data read.
A name does not grant data permissions.
A name does not grant data permissions.
Check official documentation
Compare the following points with the official documentation.
AWS Lake Formation table permissions、Data Catalog、Athena integrationの公式説明を確認する。
What to confirm
S3バケット権限とLake Formation表権限の粒度の違いを説明できる。
Key points
- Lake Formation
- Table SELECT
- Data Catalog
- Least privilege
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Two-layer evaluation
Lake Formation, IAM, S3, and KMS permissions must all permit the request.
Group management
Grant to managed groups or roles and review access periodically.