AWS Lake Formation Row-Level Security for S3 Data Hub

Apply authorization mechanisms.

Answer Correct answer: B — Register the S3 bucket in AWS Lake Formation and use row-level security to enforce country-based access policies with minimal operational effort.

A retail company has a customer data hub in an Amazon S3 bucket. Employees from many countries use the data hub to support company-wide analytics. A governance team must ensure that the company's data analysts can access data only for customers who are within the same country as the analysts. Which solution will meet these requirements with the LEAST operational effort?

Create a separate table for each country's customer data. Provide access to each analyst based on the country that the analyst serves.
Register the S3 bucket as a data lake location in AWS Lake Formation. Use the Lake Formation row-level security features to enforce the company's access policies. Correct Answer
Move the data to AWS Regions that are close to the countries where the customers are. Provide access to each analyst based on the country that the analyst serves.
Load the data into Amazon Redshift. Create a view for each country. Create separate IAM roles for each country to provide access to data from each country. Assign the appropriate roles to the analysts.

Community Votes

100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Implementing row-level security via AWS Lake Formation tests the ability to apply fine-grained authorization with minimal operational overhead compared to re-architecting data or managing multiple IAM roles.

AWS Lake Formation provides native row-level security to restrict data access in an Amazon S3 data lake based on user attributes, such as country. This solution meets the requirement with the least operational effort by avoiding data restructuring or complex IAM role management.

Choosing A or D because they seem straightforward, but they require significant ongoing operational effort to maintain separate tables, views, and IAM roles for each country.

Community Discussion (10 comments)

k350Secops 👍 12 Selected: B

AWS Lake Formation: It's specifically designed for managing data lakes on AWS, providing capabilities for securing and controlling access to data. Row-Level Security: With Lake Formation, you can define fine-grained access control policies, including row-level security. This means you can enforce policies to restrict access to data based on specific conditions, such as the country associated with each customer. Least Operational Effort: Once the policies are defined within Lake Formation, they can be centrally managed and applied to the data in the S3 bucket without the need for creating separate tables or views for each country, as in options A, C, and D. This reduces operational overhead and complexity.

dried0extents 👍 1 Selected: A

I agree that it is A

gray2205 👍 1

if the situation is not about least operational effort, D makes sense

lunachi4 👍 1 Selected: B

Select B. It means "with the LEAST operational effort".

nanaw770 👍 2 Selected: B

B is correct answer.

mattia_besharp 👍 1 Selected: B

AWS really likes Lakeformation, plus creating separate tables might require some refactoring, and the requirements is about the LEAST operational effor

rishadhb 👍 1 Selected: A

Agreed with Bartosz. I think setup DataLake, then integrate it with LakeFormation take a lot of effort than just separate the table

GiorgioGss 👍 1 Selected: B

Keyword "LEAST operational effort" - I will go with B

BartoszGolebiowski24 👍 2

Creating DataLake takes at least few days to set up and the solution should be LEAST operational. I think B is not correct.

[Removed] 👍 3 Selected: B

https://docs.aws.amazon.com/lake-formation/latest/dg/register-data-lake.html https://docs.aws.amazon.com/lake-formation/latest/dg/registration-role.html

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

AWS Lake Formation allows you to register an existing Amazon S3 bucket as a data lake and apply fine-grained access controls, including row-level security. This natively enforces the policy that analysts only8see data from their own country without requiring data duplication, restructuring, or moving the data, thus meeting the requirement with the least operational effort.

Why the Other Options Are Wrong

Option A requires2requires restructuring the data into separate tables per country and managing access to each, which introduces significant operational overhead for schema changes and data updates.
Option C involves moving data across AWS Regions, incurring high data transfer costs and massive operational complexity.
Option D requires loading data into Amazon Redshift, creating views for every country, and managing separate IAM roles, which is far more operationally heavy than using Lake Formation.

Community Comment Notes

Some users questioned if setting up Lake Formation takes too much effort, with one noting "Creating DataLake takes at least few days1few days to set up". However, the consensus is that compared to manually restructuring tables or managing Redshift views and IAM roles, Lake Formation is the least operationally intensive, as "AWS really likes Lakeformation, plus creating separate tables might require some refactoring".

Exam Strategy

For "least operational effort" questions involving fine-grained access control over S3 data, always prefer AWS Lake Formation row-level or column-level security over manual data partitioning, Redshift views, or IAM role permutations.

Related Analysis

Practice All DEA-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DEA-C01 Practice Test →

← Back to DEA-C01 Study Guide