Answer-first summary for fast verification
Answer: Use Amazon Athena to query the data. Set up AWS Lake Formation and create data filters to establish levels of access for the company's IAM roles. Assign each user to the IAM role that matches the user's PII access requirements.
AWS Lake Formation is a service designed specifically to manage access controls in an Amazon S3 data lake. It allows you to create data filters for fine-grained access control, including column-level and row-level restrictions. Using Lake Formation with Amazon Athena provides a robust and centralized way to enforce PII access limits across various user groups with the least operational effort. Options involving building custom UIs or managing complex IAM bucket policies demand significantly more effort.
Author: Ritesh Yadav
Ultimate access to all questions.
Question 6
A company stores data in a data lake that is in Amazon S3. Some data that the company stores in the data lake contains personally identifiable information (PII). Multiple user groups need to access the raw data. The company must ensure that user groups can access only the PII that they require. Which solution will meet these requirements with the LEAST effort?
A
Use Amazon Athena to query the data. Set up AWS Lake Formation and create data filters to establish levels of access for the company's IAM roles. Assign each user to the IAM role that matches the user's PII access requirements.
B
Use Amazon QuickSight to access the data. Use column-level security features in QuickSight to limit the PII that users can retrieve from Amazon S3 by using Amazon Athena. Define QuickSight access levels based on the PII access requirements of the users.
C
Build a custom query builder UI that will run Athena queries in the background to access the data. Create user groups in Amazon Cognito. Assign access levels to the user groups based on the PII access requirements of the users.
D
Create IAM roles that have different levels of granular access. Assign the IAM roles to IAM user groups. Use an identity-based policy to assign access levels to user groups at the column level.
No comments yet.