A global customer table is shared with regional teams.
Each team must read only its own region's rows.
Which authorization approach is most appropriate?
Apply Lake Formation row-level security with data filters and test joins and derived queries for leakage.
Detailed explanation
Public objects do not enforce row authorization.
Public objects do not enforce row authorization.
The service controls which rows are returned for each principal.
The service controls which rows are returned for each principal.
The API region is not the row's business-region attribute.
The API region is not the row's business-region attribute.
Athena or another query path could return all rows.
Athena or another query path could return all rows.
Check official documentation
Compare the following points with the official documentation.
AWS Lake Formation row-level security、data filters、LF-Tagsの公式説明を確認する。
What to confirm
可視化フィルターとデータレイク実体の行認可の違いを説明できる。
Key points
- Row-level security
- Data filter
- Region
- Lake Formation
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Filter design
Define missing, multiple, and changing region attributes before granting access.
Inference risk
Check aggregations and joins for ways to infer restricted values.