Question

A data engineering team manages a central data lake registered in AWS Lake Formation. A compliance auditor needs read-only access to the customer_transactions table, but must NOT be able to see the ssn or credit_card_number columns. The team wants a solution that avoids creating duplicate masked tables and can be reused for other auditors added later. Which approach best meets these requirements?

Accepted Answer

Grant the auditor SELECT permission on the table in Lake Formation using a column-level data filter that excludes the ssn and credit_card_number columns.

Answer

Create an IAM policy that denies s3:GetObject on the underlying S3 objects containing the sensitive columns and attach it to the auditor's role.

Answer

Build a Glue ETL job that copies the table into a new table with the sensitive columns removed, and grant the auditor access to the copy.

Answer

Enable server-side encryption with KMS on the table's S3 location and withhold the KMS key permissions from the auditor.