Question

A data engineering team manages a data lake where table metadata is stored in the AWS Glue Data Catalog and underlying files reside in an S3 bucket. They have enabled Lake Formation and granted a business analyst SELECT permission on a specific table through Lake Formation. However, the analyst still cannot query the table in Amazon Athena and receives an access denied error. Upon investigation, the engineer finds that the analyst's IAM identity has no S3 permissions and no Glue permissions attached directly. What is the MOST likely cause of the access failure?

Accepted Answer

The analyst's IAM identity lacks the baseline Lake Formation and Athena API permissions (such as lakeformation:GetDataAccess and athena:StartQueryExecution) needed to invoke the services, even though the data-level SELECT grant exists.

Answer

Lake Formation SELECT permissions require the analyst to also have a direct S3 bucket policy granting GetObject on the data location.

Answer

The Glue Data Catalog table must have its encryption disabled before Lake Formation grants can take effect.

Answer

Lake Formation cannot govern tables that are queried through Athena, so the grant is ignored entirely.