SAA-C03 Q73 · Security

Question

A company uses Amazon S3 to store customer data that contains personally identifiable information (PII) attributes. The company needs to make the customer information available to company resources through an AWS Glue Catalog. The company needs to have fine-grained access control for the data so that only specific IAM roles can access the PII data. What should a solutions architect do to meet these requirements?

Accepted Answer

**AWS Lake Formation** is the purpose-built service for fine-grained access control over data lakes stored in Amazon S3 and cataloged in AWS Glue Catalog.

Here's how it satisfies each requirement:

1. **Data in S3 with Glue Catalog**: Lake Formation natively integrates with both Amazon S3 (as the storage layer) and AWS Glue Data Catalog (as the metadata layer). It sits on top of Glue Catalog and adds a security/governance layer.

2. **Fine-grained access control**: This is Lake Formation's core differentiator. It provides **column-level**, **row-level**, and **cell-level** security. For PII data, you can define policies that grant access to specific columns containing PII (e.g., SSN, email) only to authorized IAM roles, while hiding those columns from others.

3. **Only specific IAM roles

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips