Question

A financial services company runs a data lake on Amazon S3 governed by AWS Lake Formation, with the Glue Data Catalog holding table definitions. Compliance auditors require a complete, queryable record of every user and role that has read specific sensitive tables, including which columns were accessed and when. The data engineering team needs to enable this auditing with the least custom development. Which approach satisfies the requirement?

Accepted Answer

Enable AWS CloudTrail data events and rely on Lake Formation's integration to log GetDataAccess and related events, then query the CloudTrail logs (or use Lake Formation's audit query capability) to review who accessed which tables and columns.

Answer

Turn on S3 server access logging on the data lake buckets and parse the logs with Athena to determine which principals read each object.

Answer

Enable Glue Data Catalog encryption with KMS and review KMS key usage in CloudTrail to identify who decrypted the catalog metadata.

Answer

Configure Amazon Macie to scan the data lake and generate findings whenever sensitive data is accessed by a principal.