Question

A data engineering team manages a data lake with hundreds of tables across dozens of databases in the AWS Glue Data Catalog, governed by AWS Lake Formation. As the organization grows, they need to grant fine-grained permissions to many teams based on data classification (e.g., 'confidential', 'public') and department ('finance', 'marketing'). Managing individual named-resource grants for each table and principal has become unmanageable. Which approach best scales permission management in Lake Formation?

Accepted Answer

Use Lake Formation tag-based access control (LF-TBAC) by defining LF-Tags, assigning them to databases/tables/columns, and granting permissions on LF-Tag expressions to principals

Answer

Create a separate IAM policy for each table and attach them directly to each team's IAM role

Answer

Move all confidential tables into a dedicated AWS account and use cross-account named-resource grants for every table

Answer

Enable S3 bucket policies with prefix-based conditions for each department and disable Lake Formation permissions