Question

A data engineering team manages a central data lake in a producer AWS account, governed by AWS Lake Formation with the Glue Data Catalog. An analytics team in a separate consumer AWS account needs read access to a specific database and several tables in the producer's catalog. The producer team wants to grant access without copying data and while retaining fine-grained control over which tables the consumer can query. What is the recommended approach to enable this cross-account access?

Accepted Answer

Grant Lake Formation permissions on the database and tables to the consumer account, which shares the resources via AWS Resource Access Manager (RAM), then have the consumer accept the invitation and create resource links.

Answer

Copy the underlying S3 data to a bucket in the consumer account and run a Glue crawler there to recreate the catalog tables.

Answer

Attach an S3 bucket policy in the producer account granting the consumer account's IAM roles direct s3:GetObject access to the data lake bucket.

Answer

Create an IAM role in the producer account with catalog read permissions and have all consumer users assume that role for every query.