DEA-C01 Question 465
Select 2A company is using Amazon Redshift to store and manage large-scale analytics data. The company has multiple teams, such as Marketing, Finance, and Product Development, which need access to the data warehouse. Each team should only have access to their respective schemas and tables. As a data engineer, you need to implement a solution that enforces these access patterns based on roles while minimizing administrative overhead. Which of the following steps should you take to implement role-based access control in Amazon Redshift?
- A
Create separate database users for each team and assign them permissions to their respective schemas.
- B
Use Amazon Redshift roles and attach them to IAM users or groups to grant schema-level access.
- C
Create groups in Redshift for each team and assign users to these groups. Grant schema-specific permissions to the groups instead of individual users.
- D
Enable Amazon Redshift column-level security to restrict access based on roles and expected queries.
- E
Use AWS Lake Formation to define permissions and enforce role-based access control for Amazon Redshift.
Show answer and explanation
Correct answers: A, C
Explanation
To enforce role-based access control in Amazon Redshift, it is recommended to use database groups to manage permissions collectively for users belonging to a team. Each group can be granted schema-specific permissions, ensuring that teams can only access their own data. While creating individual database users may work, it is less scalable than using groups. IAM roles and AWS Lake Formation are not applicable for managing schema-level access in Redshift, and column-level security is not supported natively in Redshift.
- A. Correct.
Correct. Creating separate database users ensures each team's access can be managed independently. However, managing permissions at the user level is not scalable, so this is only part of the solution.
- B. Incorrect.
Incorrect. Amazon Redshift does not use IAM roles for schema-level access control. Roles in Redshift are primarily used for managing temporary credentials for external services.
- C. Correct.
Correct. Using groups in Redshift is a best practice for managing access at scale. Groups simplify administration by allowing permissions to be managed collectively instead of individually for users.
- D. Incorrect.
Incorrect. Amazon Redshift does not natively support column-level security. Access control is typically implemented at the schema, table, or view level.
- E. Incorrect.
Incorrect. AWS Lake Formation is used for data lakes, not for managing permissions in Amazon Redshift. Permissions for Redshift are managed directly within the database.