Lake Formation Data Filters for PII Access

DEA-C01 By islever Editorial Last updated Oct 18, 2026

Apply authorization mechanisms.

Short answer

A Use Amazon Athena with AWS Lake Formation data filters to establish granular access levels for IAM roles.

Question

A company stores data in a data lake that is in Amazon S3. Some data that the company stores in the data lake contains personally identifiable information (PII). Multiple user groups need to access the raw data. The company must ensure that user groups can access only the PII that they require. Which solution will meet these requirements with the LEAST effort?

Use Amazon Athena to query the data. Set up AWS Lake Formation and create data filters to establish levels of access for the company's IAM roles. Assign each user to the IAM role that matches the user's PII access requirements. Correct Answer
Use Amazon QuickSight to access the data. Use column-level security features in QuickSight to limit the PII that users can retrieve from Amazon S3 by using Amazon Athena. Define QuickSight access levels based on the PII access requirements of the users.
Build a custom query builder UI that will run Athena queries in the background to access the data. Create user groups in Amazon Cognito. Assign access levels to the user groups based on the PII access requirements of the users.
Create IAM roles that have different levels of granular access. Assign the IAM roles to IAM user groups. Use an identity-based policy to assign access levels to user groups at the column level.

Key Takeaways

The exam tests the ability to select a managed service for least-effort security; the trap is choosing custom IAM policies or UI builders instead of native Lake Formation capabilities.

AWS Lake Formation enables fine-grained access control, such as column-level restrictions, to secure PII in Amazon S3 data lakes with minimal effort when integrated with Amazon Athena.

Common mistake: Candidates often select Option D (IAM-based policies) because they are familiar with IAM, but IAM does not support column-level filtering on S3 objects natively, making it impossible to meet the specific requirement.

Expert Analysis

Why the Answer Is Correct

Option A is the correct solution because AWS Lake Formation is specifically designed to provide centralized governance and fine-grained access control for data lakes. It integrates seamlessly with Amazon Athena, allowing administrators to create 'data filters' that enforce column-level or row-level restrictions based on IAM roles. This approach meets the 'least effort' requirement by leveraging a managed service rather than building custom logic.

Why the Other Options Are Wrong

Option D is incorrect because standard IAM identity-based policies cannot filter data at the column level within an S3 object; they only control bucket or key access. Option B is wrong because QuickSight is a visualization tool, not a data lake governance service, and relying on it limits access to dashboard users rather than raw data consumers. Option C involves building a custom UI, which violates the 'least effort' constraint compared to using a native AWS feature.

Community Comment Notes

Community consensus strongly supports Option A, noting that Lake Formation is the industry standard for this scenario. As user rralucard_ noted, "Lake Formation is designed to provide fine-grained access control... thereby meeting the requirements with the least effort." Another commenter emphasized that the combination of Athena and Lake Formation provides a comprehensive solution effectively managing PII.

Official Reference

https://docs.aws.amazon.com/lake-formation/latest/dg/fine-grained-access-control.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked for 'least effort' or 'managed' solutions for data security, prioritize AWS-native governance services like Lake Formation over custom IAM policies or third-party tools.

Frequently Asked Questions

Why can't I use IAM policies for column-level access?

Standard IAM policies control access to S3 buckets and keys but cannot parse or filter data inside those files. Lake Formation adds the capability to enforce row and column-level restrictions.

Is QuickSight suitable for securing raw data access?

No. QuickSight is for analytics and visualization. It does not govern access to the underlying raw data in S3 for general querying purposes like Athena does.

More DEA-C01 FAQ →

Community Votes

100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

rralucard_ 👍 4 Answered A

Option A, using Amazon Athena with AWS Lake Formation, is the most suitable solution. Lake Formation is designed to provide fine-grained access control to data lakes stored in S3 and integrates well with Athena, thereby meeting the requirements with the least effort. https://aws.amazon.com/blogs/big-data/anonymize-and-manage-data-in-your-data-lake-with-amazon-athena-and-aws-lake-formation/
lucas_rfsb 👍 3 Answered A

Amazon Athena to query the data and setting up AWS Lake Formation with data filters, the company can ensure that user groups can access only the personally identifiable information (PII) that they require. The combination of Athena for querying and Lake Formation for access control provides a comprehensive solution for managing PII access requirements effectively and securely
Felix_G 👍 2 Answered A

The solution that will meet the requirements with the LEAST effort is: A. Use Amazon Athena to query the data. Set up AWS Lake Formation and create data filters to establish levels of access for the company’s IAM roles. Assign each user to the IAM role that matches the user’s PII access requirements. This option leverages AWS Lake Formation to create data filters and establish access levels for IAM roles, providing a straightforward approach to managing user access based on PII requirements.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All DEA-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DEA-C01 Practice Test →

← Back to DEA-C01 Study Guide