A central data account shares a table with an analytics account.
The recipient must use the Catalog without exceeding the owner's permissions.
Which authorization approach is most appropriate?
Use Lake Formation cross-account sharing and AWS RAM, then create a resource link in the recipient Catalog.
Detailed explanation
Direct access bypasses Catalog, column controls, and audit boundaries.
Direct access bypasses Catalog, column controls, and audit boundaries.
Catalog permissions are shared without publishing the underlying bucket.
Catalog permissions are shared without publishing the underlying bucket.
Updates, confidentiality, and auditability are poor.
Updates, confidentiality, and auditability are poor.
Audit sharing does not grant Catalog data permissions.
Audit sharing does not grant Catalog data permissions.
Check official documentation
Compare the following points with the official documentation.
AWS Lake Formation cross-account data sharing、AWS RAM、resource linksの公式説明を確認する。
What to confirm
公開S3・ファイル配布と管理されたCatalog共有の違いを説明できる。
Key points
- Cross-account sharing
- AWS RAM
- Resource link
- Lake Formation
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Ownership and use
The owner keeps the permission decision while the recipient consumes the shared asset.
Revocation
Test the effect of removing a share, changing tags, or disabling a key.