AWS Certified Data Engineer – AssociateData Storage and ManagementMedium
A data engineering team is building a new data lake on Amazon S3. They need to implement a comprehensive security and governance solution that allows fine-grained access control to specific tables and columns within the data lake, based on user roles and data classifications. The solution must also integrate with AWS Glue Data Catalog and enable auditing of data access. Which AWS service is purpose-built to centralize and simplify these security and governance tasks for data lakes?
- AAWS Lake Formation
- BAmazon Macie
- CAWS IAM
- DAWS Organizations
Show answer & explanationAnswer & explanation
Correct answer: A. AWS Lake Formation
AWS Lake Formation is a service that makes it easy to build, secure, and manage data lakes. It centralizes and simplifies security, governance, and auditing by providing fine-grained access control down to the column level, integrating with the AWS Glue Data Catalog, and simplifying the setup of data access permissions for various analytics services.
Why the other options are wrong
- B. Amazon Macie is a data security and privacy service that uses machine learning to discover, classify, and protect sensitive data in AWS. It focuses on data discovery and protection, not fine-grained access control and governance for the data lake itself.
- C. AWS IAM (Identity and Access Management) is fundamental for access control but provides coarse-grained permissions at the S3 bucket/object level. It does not offer fine-grained, column-level access control for data lake tables directly without significant manual effort.
- D. AWS Organizations helps manage multiple AWS accounts but does not provide specific data lake security or governance capabilities at the table/column level.
AWS Lake Formation
A service that helps you build, secure, and manage data lakes by simplifying security, governance, and auditing, offering fine-grained access control.
- Centralized data lake security and governance
- Fine-grained access control (table, column, row level)
- Integrates with AWS Glue Data Catalog
- Simplifies permissions for analytics services
- Audits data access
Memory trick: Lake Formation is the 'Lake Guard' for your data lake's security and rules.