How to restrict S3 HR records by Region with Lake Formation?

DEA-C01 By islever Editorial Last updated Oct 17, 2026

Apply authorization mechanisms.

Short answer

BD Register the S3 path as a Lake Formation location, then enable fine-grained access control and add a Region-specific data filter for each HR department.

Question

A company has five offices in different AWS Regions. Each office has its own human resources (HR) department that uses a unique IAM role. The company stores employee records in a data lake that is based on Amazon S3 storage. A data engineering team needs to limit access to the records. Each HR department should be able to access records for only employees who are within the HR department's Region. Which combination of steps should the data engineering team take to meet this requirement with the LEAST operational overhead? (Choose two.)

Use data filters for each Region to register the S3 paths as data locations.
Register the S3 path as an AWS Lake Formation location. Correct Answer
Modify the IAM roles of the HR departments to add a data filter for each department's Region.
Enable fine-grained access control in AWS Lake Formation. Add a data filter for each Region. Correct Answer
Create a separate S3 bucket for each Region. Configure an IAM policy to allow S3 access. Restrict access based on Region.

Key Takeaways

The question tests Lake Formation location registration plus fine-grained data filters; the trap is assuming data filters are S3 data-location registrations or IAM role attachments.

This scenario tests region-scoped access to an Amazon S3 data lake using AWS Lake Formation. The correct approach is to register the S3 location and apply fine-grained data filters per HR Region, which establishes B and D as the answer.

Common mistake: A common mistake is selecting A because it mentions data filters and S3 paths; data filters control row/column visibility, not data-location registration.

Expert Analysis

Why the Answer Is Correct

B and D together implement least-overhead, region-scoped authorization in Lake Formation. Registering the S3 path as a Lake Formation location makes the data lake governable by Lake Formation permissions instead of bucket-level IAM alone. Enabling fine-grained access control allows row-level data filters, so each HR department's role can be granted a filter that exposes only rows for its Region. This centralizes policy in Lake Formation and avoids creating and maintaining five separate buckets or IAM policy variants.

Why the Other Options Are Wrong

A is wrong because data filters do not register S3 paths as data locations; location registration is a Lake Formation administrative step. C is wrong because data filters are Lake Formation grants, not IAM role policy elements that you add directly to an IAM role. E would work only with extra per-Region bucket and IAM policy management, which is higher operational overhead and does not use the central Lake Formation control the question favors.

Community Comment Notes

rralucard_ pointed to AWS Lake Formation's data-filter and fine-grained access-control documentation, which supports the B+D combination. pypelyncar similarly described registering the S3 path as the first step for Lake Formation governance and then using data filters for Region-level control. ctndba summarized B as the initial step for fine-grained control and D as the granular control that meets the requirement.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When asked for least operational overhead with region-scoped S3 access, prefer central Lake Formation policies over separate buckets and IAM variants. Separate data-location registration from row filtering: register once, then apply per-Region data filters to the HR principals.

Frequently Asked Questions

Why not create a separate S3 bucket for each HR Region?

Separate buckets multiply administration and still require per-Region IAM policies; Lake Formation data filters centralize Region scoping over one S3 data lake.

Do Lake Formation data filters attach directly to IAM roles?

No, data filters are Lake Formation grant objects; grant each filter to the HR department principal/role rather than embedding it in the IAM role policy.

More DEA-C01 FAQ →

Community Votes

100%

100% of anonymous learners picked answer BD. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

rralucard_ 👍 5

https://docs.aws.amazon.com/lake-formation/latest/dg/data-filters-about.html https://docs.aws.amazon.com/lake-formation/latest/dg/access-control-fine-grained.html
pypelyncar 👍 3

Registering the S3 path as an AWS Lake Formation location is the first step in leveraging Lake Formation's data governance and access control capabilities. This allows the data engineering team to centrally manage and govern the data stored in the S3 data lake. Enabling fine-grained access control in AWS Lake Formation and adding a data filter for each Region is the key step to achieve the desired access control. Data filters in Lake Formation allow you to define row-level and column-level access policies based on specific conditions or attributes, such as the Region in this case
rralucard_ 👍 1

If your table stored in an AWS Glue Data Catalog has tens and hundreds of thousands and millions of partitions, you can enable partition indexes on the table. With partition indexes, only the metadata for the partition value in the query’s filter is retrieved from the catalog instead of retrieving all the partitions’ metadata. The result is faster queries for such highly partitioned tables. The following table compares query runtimes between a partitioned table with no partition indexing and with partition indexing. The table contains approximately 100,000 partitions and uncompressed text data. The orders table is partitioned by the o_custkey column.
ctndba 👍 1

B: Since its a initial step for leverage fine grain control of Lakeformation. D: Give granular level control and meets the requirement
atu1789 👍 1

BD makes sense

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All DEA-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DEA-C01 Practice Test →

← Back to DEA-C01 Study Guide