Hundreds of tables are classified by sensitivity and business domain.
Apply permissions to new tables without listing every ARN.
Which authorization approach is most appropriate?
Attach LF-Tags to tables or columns and grant LF-Tag-based permissions to the appropriate principals.
Detailed explanation
Asset changes create omissions and excess maintenance.
Asset changes create omissions and excess maintenance.
Audit events do not grant data access.
Audit events do not grant data access.
Catalog-to-location changes can alter access unexpectedly.
Catalog-to-location changes can alter access unexpectedly.
Classification-based grants can apply consistently as assets grow.
Classification-based grants can apply consistently as assets grow.
Check official documentation
Compare the following points with the official documentation.
AWS Lake Formation LF-Tag based access control、grant、expressionの公式説明を確認する。
What to confirm
ARNの大量列挙とタグベース認可の保守性の違いを説明できる。
Key points
- LF-Tags
- ABAC
- Classification
- Bulk authorization
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Tag governance
Restrict who can change tags because tag changes can change access.
Default deny
Unclassified or unknown resources should have no implicit data permission.