Several analytics teams use one data lake, but each team is allowed different tables, columns, and rows.
Share without copying data into each team's bucket, while retaining owner approval and usage traceability.
Which governed-sharing design is most appropriate?
Use Lake Formation sharing and Catalog permissions to define the allowed data scope and keep approval, auditing, and revocation centralized.
Detailed explanation
Owner approval and centralized authorization are retained without creating separate copies for every team.
Owner approval and centralized authorization are retained without creating separate copies for every team.
Replication, synchronization, deletion, and audit paths multiply and can drift from the source.
Replication, synchronization, deletion, and audit paths multiply and can drift from the source.
Public access is too broad, and a file name is not an authorization boundary for rows or columns.
Public access is too broad, and a file name is not an authorization boundary for rows or columns.
Audit history is retrospective and does not establish authorization or a data-sharing boundary.
Audit history is retrospective and does not establish authorization or a data-sharing boundary.
Check official documentation
Compare the following points with the official documentation.
AWS Lake Formation data sharing、LF-Tags、column/row-level permissionsの公式説明を確認する。
Official references
What to confirm
公開バケットや個別コピーと、Catalog・所有者承認・粒度別権限を使うデータ共有の違いを説明できる。
Key points
- Lake Formation
- Data Catalog
- Data sharing
- Row and column permissions
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm the relevant DEA-C01 Skill and current AWS service documentation.
Foundation review
Owner approval
The accountable data owner confirms purpose, users, and duration before sharing.
Revocation
Remove or narrow a grant when the project or business need ends.