AWS Certified Data Engineer - Associate DEA-C01Demo

By Amazon · Question Mode

QuestionQ365

Data Security and Governance

A company operates a data lake in Amazon S3 and uses AWS Glue in multiple AWS accounts. The company must control access to databases and tables in the AWS Glue Data Catalog. Particular departments must be able to share data securely with one another. The company needs fine-grained access control that it can administer according to department ownership.

Which solution satisfies these requirements?

  • A Create IAM roles for each department with policies that grant access to specific AWS Glue databases and tables. Use resource-based policies on S3 buckets for cross-account data access.
  • B Register all S3 locations with AWS Lake Formation. Use Lake Formation tag-based access control (LF-TBAC) to assign permissions to databases and tables.
  • C Create AWS Resource Access Manager (AWS RAM) resource shares for each database and table. Grant access to specific AWS accounts and IAM principals by using AWS RAM.
  • D Enable AWS Lake Formation hybrid access mode. Use AWS Glue resource policies to share catalogs and databases across accounts and maintain IAM permissions for existing workloads.
Explanation

AWS Lake Formation tag-based access control (LF-TBAC) provides centrally managed, fine-grained permissions for AWS Glue Data Catalog databases and tables. Department ownership can be represented by LF-Tags, and permissions can be granted based on matching tag values. Lake Formation supports securely sharing tagged Data Catalog resources across AWS accounts and uses AWS RAM to facilitate those cross-account grants.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!