Lake Formation table permissions were changed and access widened.
Trace who granted or revoked which permission and when.
Which audit-log approach is most appropriate?
Collect Lake Formation API management events with CloudTrail and correlate them with approvals and alerts.
Detailed explanation
Data volume does not identify a permission change or its actor.
Data volume does not identify a permission change or its actor.
The actor, target, and time of permission changes remain available for review.
The actor, target, and time of permission changes remain available for review.
Audit evidence would be removed.
Audit evidence would be removed.
It does not cover Athena, Glue, or Lake Formation permission APIs.
It does not cover Athena, Glue, or Lake Formation permission APIs.
Check official documentation
Compare the following points with the official documentation.
AWS Lake Formation API logging、CloudTrail management events、GrantPermissionsの公式説明を確認する。
What to confirm
データ件数比較と権限変更監査の違いを説明できる。
Key points
- Lake Formation audit
- GrantPermissions
- CloudTrail
- Permission change
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Change evidence
Correlate actor, target, old and new access, approval, and ticket identifiers.
Alerting
Route high-risk grants to review and revoke unapproved changes quickly.