DEA-C01 Question 467
Single answerYour company runs a data lake on Amazon S3 with several teams accessing the data for analytics using Amazon Athena. Each team has its own S3 bucket prefix where they store their datasets. A new compliance policy mandates that teams should only access their own datasets. As a data engineer, how should you implement role-based access control to comply with this policy while minimizing administrative overhead?
- A
Create an IAM policy for each team that allows access to their specific S3 bucket prefix and attach it to each user's IAM role.
- B
Use a single IAM policy for all users that grants access to all S3 bucket prefixes and rely on the users to only access their respective data.
- C
Use AWS Lake Formation to define table-level permissions and assign permissions to specific IAM roles for each team.
- D
Enable S3 bucket policies that allow access only to specific prefixes based on the IAM role of the user.
Show answer and explanation
Correct answer: A
Explanation
The correct approach to implementing role-based access control in this scenario is to use IAM policies tied to roles. By creating a specific IAM policy for each team and limiting access to their respective S3 bucket prefixes, you ensure compliance with the policy while minimizing the administrative overhead of managing individual permissions. Other options, such as granting broad access or relying solely on S3 bucket policies, either fail to meet compliance requirements or are not practical for scalable role-based access management.
- A. Correct.
This is the correct approach because it allows you to create fine-grained access controls for each team while minimizing administrative overhead by using IAM policies tied to their roles.
- B. Incorrect.
This is incorrect because granting access to all prefixes would violate the compliance policy and relies on users to self-regulate access, which is not secure.
- C. Incorrect.
While AWS Lake Formation can provide fine-grained access control, it is primarily used for managing permissions on data in data lakes at the table level, not for directly controlling S3 bucket prefix access.
- D. Incorrect.
This is incorrect because S3 bucket policies alone cannot dynamically manage access based on IAM roles in a scalable manner for multiple teams.