DEA-C01 Question 449
Select 2You are designing an Amazon Redshift data warehouse for your company and need to ensure that different teams have access only to the data they are authorized to view. The Finance team should only access financial data, while the Marketing team should only access campaign-related data. Which mechanisms should you implement to achieve this, while adhering to AWS best practices for authorization?
- A
Create separate IAM roles for the Finance and Marketing teams, and attach them to their respective users or groups, granting access to specific schemas in Amazon Redshift.
- B
Use Amazon Redshift's row-level security policies to restrict access to rows within tables based on the user's group membership.
- C
Grant access to the tables directly to individual users in Amazon Redshift using SQL GRANT statements.
- D
Leverage AWS Lake Formation to set fine-grained permissions on the data lake, and query the data using Amazon Redshift Spectrum.
- E
Enable Amazon Redshift data sharing and configure resource-level permissions for each team to access only their portion of shared datasets.
Show answer and explanation
Correct answers: A, D
Explanation
AWS recommends using IAM roles and policies for managing access to resources like Amazon Redshift schemas. This ensures scalability and centralized management of permissions. Additionally, AWS Lake Formation enables fine-grained access control for data stored in the data lake, which can be queried via Amazon Redshift Spectrum, thereby complementing the authorization mechanisms. Direct user-level permissions and features like data sharing do not align with best practices for achieving secure, scalable authorization.
- A. Correct.
This is correct. Creating IAM roles and granting permissions specific to schemas is an AWS best practice for managing access control in Amazon Redshift. Roles allow for centralized authorization management.
- B. Incorrect.
This is incorrect. Amazon Redshift does not natively support row-level security; you would need to implement such restrictions through custom views or other mechanisms.
- C. Incorrect.
This is incorrect. Granting access to individual users directly is not scalable or aligned with AWS best practices. Roles and groups should be used instead.
- D. Correct.
This is correct. AWS Lake Formation supports fine-grained access control, and when combined with Amazon Redshift Spectrum, you can enforce these policies on data stored in S3.
- E. Incorrect.
This is incorrect. While data sharing in Amazon Redshift allows sharing datasets across clusters, it does not provide fine-grained access control at the team level.