An S3 data lake is queried with Athena, and each department may view different columns.
Keep the data in shared buckets, manage access at the catalog level, and prevent public exposure.
Which design is most appropriate?
Register the data in the Glue Data Catalog and use Lake Formation permissions to control access at database, table, and column granularity without making the bucket public.
Detailed explanation
CloudFront controls delivery caching, not catalog authorization or Athena column permissions.
CloudFront controls delivery caching, not catalog authorization or Athena column permissions.
Broad permissions and public access violate least privilege and data protection requirements.
Broad permissions and public access violate least privilege and data protection requirements.
S3 access paths remain too broad when application filtering is the only control.
S3 access paths remain too broad when application filtering is the only control.
Lake Formation centralizes fine-grained permissions for cataloged assets, allowing Athena users to query without exposing the S3 bucket.
Lake Formation centralizes fine-grained permissions for cataloged assets, allowing Athena users to query without exposing the S3 bucket.
Check official documentation
Compare the following points with the official documentation.
AWS Lake Formation data permissions and Glue Data Catalogの公式説明を確認する。
What to confirm
データレイクの保存場所、メタデータ、分析クエリの認可を分離して設計できる。
Key points
- AWS Lake Formation
- Glue Data Catalog
- Column-level permissions
Notes
- Environment:
- Confirm current behavior in the official SAA-C03 guide and AWS service documentation.
Foundation review
Lake boundary
Separate the S3 location, catalog metadata, and authorization layer.
Sharing versus public access
Authorized sharing does not require anonymous access to the bucket.