AWS Certified Data Engineer - Associate DEA-C01Demo

By Amazon · Question Mode

QuestionQ163

Data Security and Governance

A company operates five offices in separate AWS Regions. Each office has its own human resources (HR) department, which uses a distinct IAM role. The company keeps employee records in a data lake based on Amazon S3 storage.

A data engineering team must restrict access to the records. Each HR department must be able to access records only for employees in that HR department's Region.

Which combination of steps should the data engineering team take to satisfy this requirement with the LEAST operational overhead?

Choose two
  • A Use data filters for each Region to register the S3 paths as data locations.
  • B Register the S3 path as an AWS Lake Formation location.
  • C Modify the IAM roles of the HR departments to add a data filter for each department's Region.
  • D Enable fine-grained access control in AWS Lake Formation. Add a data filter for each Region.
  • E Create a separate S3 bucket for each Region. Configure an IAM policy to allow S3 access. Restrict access based on Region.
Explanation

AWS Lake Formation data filters can enforce row-level access by applying a Region-specific filter when granting SELECT permissions to each HR IAM role. The Amazon S3 location containing the data must be registered with Lake Formation so that Lake Formation can control access to the underlying data. This provides centralized, fine-grained access control without creating and managing separate S3 buckets or Region-specific IAM policies.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!