How to Enforce Column-Level Athena Access with AWS Lake Formation?
A company has a data lake on AWS. The data lake ingests sources of data from business units. The company uses Amazon Athena for queries. The storage layer is Amazon S3 with an AWS Glue Data Catalog as a metadata repository. The company wants to make the data available to data scientists and business analysts. However, the company first needs to manage fine-grained, column-level data access for Athena based on the user roles and responsibilities. Which solution will meet these requirements?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The item tests selection of Lake Formation for fine-grained column-level authorization in Athena; the trap is confusing IAM policies on Glue tables with actual data-lake column permissions.
Column-level access control for Amazon Athena over an S3 data lake and AWS Glue Data Catalog is implemented with AWS Lake Formation. This page establishes that option A is correct and explains why IAM policies and AWS RAM do not provide per-column authorization.
The most tempting wrong answer is C, an IAM identity-based policy for AWS Glue tables, because IAM is familiar, but it authorizes Glue API operations rather than filtering access to specific columns in Athena queries.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
AWS Lake Formation is the AWS service designed to centralize fine-grained permissions for data lakes built on Amazon S3 and the AWS Glue Data Catalog. It can grant or deny access at the catalog, database, table, and column level, and those permissions are enforced for Athena queries. Because the company needs column-level access differentiated by user role, Lake Formation's policy-based rules tied to IAM roles satisfy the requirement directly. This is why option A is correct.Why the Other Options Are Wrong
Option B is invalid because an IAM resource-based policy attached to Glue tables or user groups cannot express column-level table permissions for Athena. Option C sounds close, but IAM identity-based policies for Glue authorize API actions such as GetTable rather than filtering columns within query results. Option D is wrong because AWS RAM shares resources across accounts or organizational units; it is not a column-level authorization mechanism for Athena users in this data lake.Community Comment Notes
Ja13 explains that Lake Formation allows you to define "fine-grained access control policies at the database, table, and column levels," which matches the requirement. tgv adds that Lake Formation supports column-level permissions, reinforcing the key differentiator from plain Glue/IAM policies. HagarTheHorrible and HunkyBunky also converge on Lake Formation for any fine-grained access scenario, so the community consensus supports A.Official Reference
Exam Strategy
When a question mentions column-level or table-level access for Athena on S3/Glue, look for Lake Formation rather than generic IAM or RAM. Distinguish IAM authorization of Glue APIs from Lake Formation's data-lake permissions, which are the ones that enforce fine-grained access.
Frequently Asked Questions
Why can't an IAM identity-based policy on AWS Glue tables enforce column-level access for Athena?
IAM policies control which Glue API actions and resources a role can use; they do not express per-column grants inside a table, which Lake Formation column-level permissions provide.
Does AWS RAM resource sharing replace Lake Formation for this data lake?
No. AWS RAM shares resources such as Glue Data Catalog databases or tables, but it does not itself define fine-grained column-level permissions for Athena queries.
Related Analysis
Practice All DEA-C01 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DEA-C01 Practice Test →