Exams / SAP-C03 / Study guide / Data lakes, lakehouses and data sharing (Lake Formation, Iceberg, Clean Rooms)
Data lakes, lakehouses and data sharing (Lake Formation, Iceberg, Clean Rooms): SAP-C03 study notes and practice questions
What to know about Data lakes, lakehouses and data sharing (Lake Formation, Iceberg, Clean Rooms) for the SAP-C03 exam, from the Architecture Design and Implementation Built for the Cloud domain (25% of the exam guide), then 1 free question to test it. Part of the SAP-C03 study guide.
SAP-C03 asks how to build a governed data lake that many accounts can query, how to support updates and time travel on S3 data, and how to analyze data with partners without exposing it.
Building blocks
S3 zones (raw, cleaned, curated) in open columnar formats such as Parquet, partitioned for pruning.
AWS Glue Data Catalog: the shared metastore for Athena, EMR, Redshift Spectrum and Glue; crawlers infer schemas.
Apache Iceberg tables add ACID transactions, row-level updates and deletes, schema evolution and time travel on S3. Amazon S3 Tables store Iceberg tables in table buckets with automatic compaction and snapshot management.
Query engines: Athena (serverless SQL), Redshift Spectrum (join S3 data with warehouse tables), EMR (Spark, Hive, Trino).
Governance with Lake Formation
Central permissions on databases, tables, columns, rows and cells (data filters), enforced across Athena, Redshift Spectrum, EMR and Glue.
LF-Tags (tag-based access control) scale permissions: grant on tags such as domain=finance, sensitivity=pii instead of per table.
Cross-account sharing: grant tables or LF-Tags to another account or organization unit; Lake Formation uses AWS RAM underneath, and the consumer creates resource links. This supports a data mesh, with producer accounts owning data and a central governance account.
Other sharing options
Redshift data sharing: live, read-only access to Redshift data across clusters, workgroups, accounts and Regions with no copies.
AWS Clean Rooms: partners analyze combined data while each keeps it in place; analysis rules (aggregation, list, custom) limit which queries may run and what results return, with options such as differential privacy and Clean Rooms ML for lookalike modeling.
How to choose
Scenario wording
Choose
“Analysts in many accounts query the lake, column-level control”
Lake Formation with cross-account grants
“Thousands of tables, permissions by classification”
LF-Tags
“Update and delete individual records in S3 data (GDPR erasure)”
Iceberg tables (S3 Tables)
“Join S3 history with Redshift tables”
Redshift Spectrum
“Two companies match customers without sharing raw data”
AWS Clean Rooms
“Share live warehouse data with another business unit”
Redshift data sharing
Common traps
Bucket policies and IAM per table at scale instead of Lake Formation.
Copying data into each consumer account rather than sharing in place.
Rewriting whole partitions for row-level changes instead of using Iceberg.
Raw CSV and no partitions when the ask is faster, cheaper queries.
Sending partners a data extract when the requirement forbids exposing raw records.
A retailer keeps its sales history as Apache Iceberg tables in an Amazon S3 data lake, owned by the merchandising account and cataloged in AWS Glue. The finance account needs to query sales tables with Amazon Athena, but it must not see the customer columns in those tables.
The data owner's team does not want copies of the data in other accounts, because copies drift from the source. The retailer also needs one place to see who has access to each column.
Which solution meets these requirements?
Choose one answer.
AA. Run a nightly AWS Glue job that copies the sales tables into an S3 bucket in the finance account and removes the customer columns during the copy, and catalog the copy there for Athena.
BB. Add a bucket policy to the merchandising bucket that lets the finance account's role read every object under the sales prefix. Athena then reads the Iceberg files directly.
CC. Grant the finance account access through AWS Lake Formation with column-level permissions on the sales tables. Create resource links to those tables in the finance account's Glue catalog, so Athena queries the source data.
DD. Load the sales tables into an Amazon Redshift Serverless namespace in the finance account every night, and grant column-level access to the finance users inside Redshift.
Show the answer and explanation
Answer: C
A. Wrong: Nightly copies create a second dataset that can drift from the source, which the data owner wants to avoid. Removing columns in each copy also spreads the access rules across two places.
B. Wrong: A bucket policy grants read access to whole objects, so the customer columns inside the Iceberg files would be readable. Column-level restrictions are not available through the bucket policy.
C. Right: Correct. Lake Formation applies column-level grants on the source tables across accounts, so the customer columns stay hidden. Resource links let Athena in the finance account query the single source without making a copy.
D. Wrong: This design hides the columns, but it loads a second copy of the data each night. It also moves the queries off the lake that the finance team uses through Athena.
Explanation
Lake Formation cross-account grants with column permissions and resource links give column-level access to one source with no copies. Bucket policies cannot restrict columns, and nightly copies or a warehouse load create drift and a second place to manage access.
Want more on Data lakes, lakehouses and data sharing (Lake Formation, Iceberg, Clean Rooms)? The 5 full-length practice sets have 6 more Data lakes, lakehouses and data sharing (Lake Formation, Iceberg, Clean Rooms) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Data lakes, lakehouses and data sharing (Lake Formation, Iceberg, Clean Rooms)