Question

A data engineer registers a new S3 data lake location with AWS Lake Formation and creates several databases and tables in the Glue Data Catalog. The team wants Lake Formation permissions to be the sole mechanism controlling access to these tables. However, after granting fine-grained SELECT permissions to specific analyst roles, they discover that IAM principals with broad Glue and S3 permissions can still access the tables directly. What is the root cause and correct fix?

Accepted Answer

The IAMAllowedPrincipals group still has Super permission on the databases and tables; revoke it so only explicit Lake Formation grants apply.

Answer

Lake Formation cannot govern Glue Catalog tables unless a resource link is created; create resource links for each table.

Answer

The S3 bucket policy is overriding Lake Formation; remove all S3 bucket policies to let Lake Formation take effect.

Answer

KMS key policies are granting access; update the CMK policy to deny the analyst roles direct decrypt access.