Implementing Row-Level Security with AWS Lake Formation

DEA-C01 By islever Editorial Last updated

Apply authorization mechanisms. Perform data ingestion.

Short answer

B Use AWS Lake Formation row-level security to enforce country-based access policies on the S3 data lake with minimal operational effort.

Question

A retail company has a customer data hub in an Amazon S3 bucket. Employees from many countries use the data hub to support company-wide analytics. A governance team must ensure that the company's data analysts can access data only for customers who are within the same country as the analysts.
Which solution will meet these requirements with the LEAST operational effort?
  1. Create a separate table for each country's customer data. Provide access to each analyst based on the country that the analyst serves.
  2. Register the S3 bucket as a data lake location in AWS Lake Formation. Use the Lake Formation row-level security features to enforce the company's access policies. Correct Answer
  3. Move the data to AWS Regions that are close to the countries where the customers are. Provide access to each analyst based on the country that the analyst serves.
  4. Load the data into Amazon Redshift. Create a view for each country. Create separate IAM roles for each country to provide access to data from each country. Assign the appropriate roles to the analysts.

Key Takeaways

AWS Lake Formation's row-level security feature allows fine-grained access control directly on S3 data without needing physical data separation or complex IAM policies.

Learn how to implement row-level security in an Amazon S3 data hub using AWS Lake Formation to restrict analyst access by country with the least operational effort.

Common mistake: Choosing Option A (separate tables) or Option D (Redshift views) often stems from misunderstanding the term 'least operational effort,' leading to solutions that require more setup and maintenance than Lake Formation.

Expert Analysis

The scenario requires enforcing row-level security (RLS) on data stored in Amazon S3 with the least operational effort. AWS Lake Formation is the native service designed to secure and manage data lakes on S3. It provides a centralized way to register S3 buckets as data lake locations and apply fine-grained access controls, including row-level permissions based on attributes like country.

Option B is correct because Lake Formation allows you to define permissions that restrict access to specific rows (e.g., country = 'US') without requiring physical data segregation or complex IAM policy logic for every query engine. This significantly reduces operational overhead compared to managing separate tables or regions.

Option A involves creating separate tables per country, which increases storage costs, management complexity, and operational effort, violating the "least effort" constraint. Option C suggests moving data to different AWS Regions, which adds latency, cost, and complexity without solving the logical access control problem natively. Option D involves loading data into Amazon Redshift and creating views/IAM roles, which is a more complex architecture than necessary when Lake Formation can handle RLS directly on S3 data sources supported by services like Athena or Glue.

Exam Strategy

When questions emphasize 'least operational effort' or 'native integration,' prioritize managed services that offer built-in features over custom architectures. For data security in S3, always consider AWS Lake Formation first for fine-grained access control before resorting to manual IAM policies or data duplication strategies.

Frequently Asked Questions

Why not use IAM policies for row-level security?

IAM policies are resource-based and cannot easily enforce row-level restrictions within a single dataset. Lake Formation provides native support for attribute-based access control (ABAC) and row-level filtering.

Does Lake Formation support all query engines?

Lake Formation integrates with Amazon Athena, AWS Glue, and other compatible engines to enforce permissions consistently across different data processing workloads.

More DEA-C01 FAQ →

Community Votes

B
86%
A
14%

86% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 15 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 15

  1. k350Secops 👍 15 Answered B
    AWS Lake Formation: It's specifically designed for managing data lakes on AWS, providing capabilities for securing and controlling access to data. Row-Level Security: With Lake Formation, you can define fine-grained access control policies, including row-level security. This means you can enforce policies to restrict access to data based on specific conditions, such as the country associated with each customer. Least Operational Effort: Once the policies are defined within Lake Formation, they can be centrally managed and applied to the data in the S3 bucket without the need for creating separate tables or views for each country, as in options A, C, and D. This reduces operational overhead and complexity.
  2. BartoszGolebiowski24 👍 2
    Creating DataLake takes at least few days to set up and the solution should be LEAST operational. I think B is not correct.
  3. nanaw770 👍 2 Answered B
    B is correct answer.
  4. ambikamma 👍 1 Answered B
    Option B best meets the requirement with the least operational effort because AWS Lake Formation supports row-level security directly on S3 data. By registering the S3 data lake and applying row-level permissions, analysts can be restricted to view only the customer records from their country without needing separate tables, views, or region-specific copies of data.
  5. xxxdolorxxx 👍 1 Answered B
    A: Seems like too much effort. B: Seems to be correct. C: Regions wouldn't do anything. No reason to move the data D: Loading data into redshift requires more operational effort than B.
Show 10 more comments
  1. mattia_besharp 👍 1 Answered B
    AWS really likes Lakeformation, plus creating separate tables might require some refactoring, and the requirements is about the LEAST operational effor
  2. rishadhb 👍 1 Answered A
    Agreed with Bartosz. I think setup DataLake, then integrate it with LakeFormation take a lot of effort than just separate the table
  3. lunachi4 👍 1 Answered B
    Select B. It means "with the LEAST operational effort".
  4. GiorgioGss 👍 1 Answered B
    Keyword "LEAST operational effort" - I will go with B
  5. Tiger4Code 👍 1 Answered B
    row level filter in data lake formation
  6. tkyangbo 👍 1 Answered B
    B is the least operational effort
  7. swadesh2001 👍 1 Answered B
    The correct answer is B
  8. Mike_27 👍 1 Answered B
    Strongly agree with B
  9. dried0extents 👍 1 Answered A
    I agree that it is A
  10. dade0c1 👍 1 Answered B
    row level security

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Amazon Redshift Compound Sort Key Query Optimization

S-grade

Secure Redshift Spectrum Access with VPC Endpoints

S-grade

Athena Federated Query for Multi-Source Iceberg Pipelines

S-grade

Reclaiming Storage in Amazon Redshift Materialized Views

S-grade

Practice All DEA-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DEA-C01 Practice Test →

← Back to DEA-C01 Study Guide