A retail company has a customer data hub in an Amazon S3 bucket. Employees from many countries use the data hub to support company-wide analytics. A governance team must ensure that the company's data analysts can access data only for customers who are within the same country as the analysts.
Which solution will meet these requirements with the LEAST operational effort?
The best solution for ensuring that data analysts can access data only for customers within the same country with the least operational effort is to register the S3 bucket as a data lake location in AWS Lake Formation. This service provides powerful data governance and fine-grained access control capabilities, including row-level security. By using Lake Formation’s row-level security features, you can easily define and enforce policies that restrict access to data based on specific conditions such as the country of the customer. This approach avoids the need for creating separate tables, views, or managing regional data migrations, thereby reducing operational overhead and complexity.
AWS Lake Formation: It's specifically designed for managing data lakes on AWS, providing capabilities for securing and controlling access to data. Row-Level Security: With Lake Formation, you can define fine-grained access control policies, including row-level security. This means you can enforce policies to restrict access to data based on specific conditions, such as the country associated with each customer. Least Operational Effort: Once the policies are defined within Lake Formation, they can be centrally managed and applied to the data in the S3 bucket without the need for creating separate tables or views for each country, as in options A, C, and D. This reduces operational overhead and complexity.
Creating DataLake takes at least few days to set up and the solution should be LEAST operational. I think B is not correct.
B is correct answer.
https://docs.aws.amazon.com/lake-formation/latest/dg/register-data-lake.html https://docs.aws.amazon.com/lake-formation/latest/dg/registration-role.html
Keyword "LEAST operational effort" - I will go with B
Agreed with Bartosz. I think setup DataLake, then integrate it with LakeFormation take a lot of effort than just separate the table
AWS really likes Lakeformation, plus creating separate tables might require some refactoring, and the requirements is about the LEAST operational effor
Select B. It means "with the LEAST operational effort".