Question

A data engineer uses AWS Lake Formation with tag-based access control (LF-TBAC). They assign the LF-Tag 'Classification=Confidential' to a database named 'finance_db'. The database contains 40 tables, none of which have any LF-Tags directly assigned to them. An analyst is granted SELECT permission on resources matching the LF-Tag expression 'Classification=Confidential'. What access will the analyst have to the tables in 'finance_db'?

Accepted Answer

The analyst can query all 40 tables, because LF-Tags assigned to a database are inherited by all tables within it unless a table overrides the tag.

Answer

The analyst cannot query any tables, because LF-Tags must be assigned directly to each table for permissions to apply.

Answer

The analyst can query the tables only after an IAM policy is attached granting explicit s3:GetObject on the underlying data.

Answer

The analyst can query only the database metadata, not the table data, until a data filter is created for each table.