Question

A healthcare company stores patient records in an S3 data lake governed by AWS Lake Formation and cataloged in the Glue Data Catalog. Analysts in the research team must be able to query the patients table, but they should only see rows where the consent_flag column equals 'true', and they must not see the ssn or full_name columns. Compliance requires that this restriction be enforced centrally without duplicating or transforming the underlying data. What is the MOST efficient way to meet these requirements?

Accepted Answer

Create a Lake Formation data filter that combines a row-level filter expression on consent_flag with column-level exclusion of ssn and full_name, then grant SELECT on the table to the research role using that filter.

Answer

Create a Glue ETL job that writes a filtered and column-pruned copy of the table to a separate S3 prefix and grant the research role access only to that prefix.

Answer

Attach an IAM policy to the research role that denies s3:GetObject on the objects containing ssn and full_name values.

Answer

Enable Redshift dynamic data masking on the patients table so ssn and full_name are masked for the research role.