A customer table contains email and general analytics columns.
Share only the general columns with analysts.
Which authorization approach is most appropriate?
Use Lake Formation column-level SELECT so the role cannot query the sensitive column.
Detailed explanation
Another query path could still reveal the column.
Another query path could still reveal the column.
Authorization prevents the sensitive column from being returned.
Authorization prevents the sensitive column from being returned.
Removing audit records does not change authorization.
Removing audit records does not change authorization.
Direct object access could bypass the intended column boundary.
Direct object access could bypass the intended column boundary.
Check official documentation
Compare the following points with the official documentation.
AWS Lake Formation column-level permissions、named resource、LF-tagsの公式説明を確認する。
What to confirm
QuickSightの表示制御と実データ列認可の違いを説明できる。
Key points
- Column-level permission
- Lake Formation
- Sensitive column
- Least privilege
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Bypass prevention
Check direct S3, Glue jobs, and alternative Catalog paths against the same policy.
Masked view
Use a separate masked dataset when analysts do not need the original value.