Question

A data engineering team manages a data lake registered with AWS Lake Formation. A compliance auditor needs a complete, centralized record of every principal that has queried or accessed data lake tables and columns over the past 90 days, including which specific columns were read. The team wants to enable this auditing with minimal custom development. Which approach meets the requirement?

Accepted Answer

Enable AWS CloudTrail data events and rely on Lake Formation to log data access events, then query the CloudTrail logs to review principal-level access to tables and columns.

Answer

Enable S3 server access logging on the underlying data lake buckets and parse the logs to determine which IAM users accessed which objects.

Answer

Turn on Amazon Macie on the data lake buckets to continuously classify data and produce access reports for each principal.

Answer

Configure Glue Data Catalog crawlers to run daily and capture a history of who queried each table in the crawler run logs.