Question

A financial services company stores customer transaction data in a data lake on Amazon S3, cataloged in the AWS Glue Data Catalog. A team of data analysts needs to query the data through Amazon Athena, but they must NOT be able to see the columns containing customer Social Security numbers and account numbers. The security team wants centralized, fine-grained access control that does not require modifying the underlying S3 objects or maintaining separate copies of the data. What is the MOST appropriate way to meet these requirements?

Accepted Answer

Use AWS Lake Formation to grant the analyst role SELECT permission on the table with column-level filtering that excludes the sensitive columns.

Answer

Create a separate S3 bucket containing a redacted copy of the data with sensitive columns removed, and point the analysts to a Glue table over that bucket.

Answer

Attach an IAM policy to the analyst role that denies s3:GetObject on the objects containing sensitive columns.

Answer

Enable S3 bucket default encryption with a KMS key and deny the analysts access to the KMS key used for the sensitive columns.