An advertising company uses AWS Lake Formation to manage a data lake. The data lake contains structured data and unstructured dat a. The company's ML…

The most operationally efficient solution is to use AWS Lake Formation's native capabilities for fine-grained access control. Lake Formation Tag-Based Access Control (LF-TBAC) is designed for this exact scenario. By assigning LF-Tags to Data Catalog resources (which represent the data in Amazon S3) based on campaign, and then granting permissions on those tags to the corresponding ML engineers' roles, the company can manage access centrally. This single policy framework is enforced for users accessing data through both Amazon Athena and directly in S3 (via Lake Formation's credential vending), meeting all requirements in a unified and scalable manner.

A: This approach is incomplete as it only addresses access through Athena and the AWS Glue Data Catalog, but not direct S3 bucket access.

B: This is an overly complex, custom-built solution that is not operationally efficient. It also only solves for S3 access, ignoring the Athena requirement.

D: This method only controls direct S3 bucket access and does not manage permissions for queries run through Athena. It also becomes difficult to manage at scale.

1. AWS Lake Formation Developer Guide

"Tag-based access control with AWS Lake Formation": This guide explicitly describes using LF-Tags to manage permissions at scale. It states

"You can define LF-tags and assign them to Data Catalog resources... You then grant permissions on those LF-tags to principals. Lake Formation allows operations on the resources if the principal has permissions on the LF-tags for that resource." This directly supports the methodology in option C.

URL: https://docs.aws.amazon.com/lake-formation/latest/dg/tag-based-access-control.html

2. AWS Lake Formation Developer Guide

"How data access control works in Lake Formation": This document explains that Lake Formation provides a single place to manage access controls for data in an S3 data lake

which are then enforced across multiple services like Amazon Athena. This highlights the operational efficiency of a centralized model.

URL: https://docs.aws.amazon.com/lake-formation/latest/dg/how-it-works-access-control.html

3. AWS Big Data Blog

"Govern your data lake centrally with AWS Lake Formation tag-based access control": This official blog post details the exact use case of using tags to grant permissions to different groups (like ML engineers for specific campaigns)

confirming it as the intended and most efficient pattern.

URL: https://aws.amazon.com/blogs/big-data/govern-your-data-lake-centrally-with-aws-lake-formation-tag-based-access-control/