Permissions with Lake Formation: DEA-C01 study notes and practice questions
What to know about Permissions with Lake Formation for the DEA-C01 exam, from the Data Security and Governance domain (18% of the exam guide), then 3 free questions to test it. Part of the DEA-C01 study guide.
Lake Formation questions ask how to give different users different columns or rows of the same S3 data, or share tables with other accounts.
What it does
Manages permissions on Data Catalog resources with GRANT and REVOKE, instead of complex S3 bucket policies.
Column-level grants include or exclude columns, such as hiding ssn.
Data filters give row-level and cell-level security, such as “region = ‘EU’” with some columns hidden.
LF-Tags (tag-based access control): tag databases, tables and columns (such as classification=confidential) and grant on tag expressions. This scales to thousands of tables.
Registered locations: Lake Formation vends temporary credentials to integrated services, so users don’t need direct S3 access.
Hybrid access mode lets you adopt Lake Formation for some users while others keep IAM-based access.
Who enforces it
Athena, Redshift Spectrum, Glue ETL, EMR, Quick Sight and SageMaker respect Lake Formation permissions when they read registered data.
Cross-account sharing
Share databases or tables (or LF-Tags) with another account or organization; Lake Formation uses AWS RAM.
The receiving account creates a resource link to query the shared table.
No data is copied.
Admin concepts
Data lake administrators grant permissions.
Turning off the “use only IAM access control” defaults is needed for Lake Formation permissions to take effect on new resources.
CloudTrail records data access through Lake Formation.
Common traps
Separate copies of a table for each team to hide columns. Use column grants or data filters.
S3 bucket policies per prefix for hundreds of tables. Use LF-Tags.
Granting IAM S3 access directly around Lake Formation, which bypasses its controls.
A hospital group's data lake catalogs its encounter data in AWS Glue, and analysts query it with Amazon Athena. The table has 80 columns, and 12 of them hold patient identifiers and diagnosis codes. Analysts in the operations group must see only the other columns.
The table was created with the default Lake Formation settings, so anyone with an IAM policy for the Glue table can read every column. The data team wants Lake Formation to enforce the column restriction for Athena queries.
Which change meets these requirements?
Choose one answer.
AA. Add an IAM policy to the operations group that denies the Athena actions on the table, and grant the group access through a new bucket policy.
BB. Create a view in Athena that excludes the 12 sensitive columns, and tell the operations group to query the view instead of the table.
CC. Copy the table to a new S3 prefix without the 12 columns each night, and give the operations group access to the copy only.
DD. Revoke the Super permission from the IAMAllowedPrincipals group on the table, then grant the operations group SELECT on only the 68 permitted columns in Lake Formation.
Show the answer and explanation
Answer: D
A. Wrong: IAM policies on the table and the bucket do not restrict individual columns in Athena queries, and the default settings still let IAM grant full table access. The option cannot enforce a column-level rule.
B. Wrong: A view works as a workaround, but the analysts' IAM policy would still allow reading the base table. The option does not enforce the restriction on the table itself.
C. Wrong: The nightly copy is a separate data set that must be kept in sync and governed. The option does not use Lake Formation to enforce the restriction.
Lake Formation can restrict individual columns, but its default grant to IAMAllowedPrincipals makes IAM policies the only control. Revoking that Super grant on the table lets Lake Formation enforce the permissions, and column-level SELECT then limits what the operations group can see in Athena. Bucket policies, IAM denies, views and copies do not enforce the same rule.
A telecom company's data lake has 400 Glue tables across 20 databases, and new tables are added every week. Columns that hold personal data, such as phone numbers and birth dates, appear in many of them. Data analysts may see only columns that are not tagged as personal.
Granting access table by table has not kept up with new tables, and the security team wants access rules that apply automatically to tables and columns added later.
Which approach meets these requirements?
Choose one answer.
AA. Tag the databases sensitivity=general, override the personal columns with sensitivity=personal, and grant analysts SELECT on the expression sensitivity=general.
BB. Create a Lake Formation grant for each table and each analyst group when a new table appears, using a runbook for the data team to follow.
CC. Make a masked copy of each table with the personal columns removed, and give analysts access to the copies in a separate database.
DD. Give the analysts an IAM policy that lists the names of the non-personal columns for each table, and update the policy each week.
Show the answer and explanation
Answer: A
A. Right: Correct. Tables and columns inherit LF-tags from their database, and a column can override the inherited value. A grant on sensitivity=general covers every matching column, including those in tables added later, while columns tagged personal stay hidden. Learn more: Lake Formation tag-based access control (opens in a new tab)
B. Wrong: Per-table grants depend on the runbook being followed for every new table, which is the process that has already fallen behind. The option does not apply rules automatically to new tables.
C. Wrong: Masked copies double the number of tables and need a copy process for every new table. The option adds the work the team wants to remove.
D. Wrong: IAM policies cannot evaluate column tags in Lake Formation, and a weekly update of column lists is manual maintenance. The option does not scale to 400 tables.
Explanation
LF-tags let the security team classify data once and grant access by tag expression. Tables and columns inherit the database's tag, personal columns override it, and the analysts' grant on the general value covers new tables automatically. Per-table grants, masked copies and IAM column lists each need manual upkeep for every new table.
A grocery chain's producer account holds a shipments table in the Glue Data Catalog. A consumer account belongs to the regional managers' analytics team. Each regional manager may query only the rows for their own region, and the consumer account's analysts use Athena.
The producer's data team wants the rule enforced by Lake Formation, not by copying the data, and the regions must not be visible to each other.
Which TWO actions meet these requirements? (Choose two.)
Choose two answers.
AA. Copy the shipments table into the consumer account with a region filter in the copy job, and let the analysts query the copy.
BB. Give the consumer account an S3 bucket policy that allows read access to the shipments prefix, and let the analysts filter rows in their queries.
CC. Give every consumer analyst a copy of the producer's IAM role, so that the analysts can call the Glue API directly against the producer's catalog.
DD. Create a Lake Formation data filter on the shipments table that keeps only the rows for each region, and grant the filter to the consumer account's principals.
EE. Create a resource link in the consumer account that points to the shared shipments table, so that the consumer's database can grant access to the analysts.
Show the answer and explanation
Answers: D, E
A. Wrong: A copy duplicates the data and needs a job to keep it current, and the filter in the job is not enforced by Lake Formation. The option breaks the no-copy requirement.
B. Wrong: A bucket policy grants access to whole objects and cannot restrict rows. Analysts could see every region, which the producer does not allow.
C. Wrong: Sharing a role across accounts gives every analyst the producer's full access, which the regional rule forbids. The option grants far more than the regional rule allows.
D. Right: Correct. A data filter defines the rows a principal may see, and Lake Formation enforces it at query time in Athena. Granting the filter to the consumer account keeps the rule in the producer's control without copying data. Learn more: Data filters in Lake Formation (opens in a new tab)
E. Right: Correct. A resource link lets the consumer account reference a shared table in its own catalog, so the consumer's Lake Formation grants can reach the shared table. Combined with the data filter, the analysts see only their region's rows. Learn more: Cross-account data sharing in Lake Formation (opens in a new tab)
Explanation
Cross-account sharing in Lake Formation uses two parts. A data filter in the producer account limits the rows a consumer principal can see, which enforces the regional rule at query time. A resource link in the consumer account lets its Lake Formation grants reach the shared table, so no data is copied. Copies, bucket policies and shared roles each break the no-copy or regional-visibility requirement.
Want more on Permissions with Lake Formation? The 5 full-length practice sets have 10 more Permissions with Lake Formation questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →