Question

A data engineer grants a data analyst SELECT permission on a Glue Data Catalog table using AWS Lake Formation. The underlying data is stored in an S3 location that Lake Formation manages (the S3 location is registered with Lake Formation). When the analyst runs an Athena query against the table, the query fails with an access-denied error on the S3 objects, even though Lake Formation shows the SELECT grant. The analyst's IAM role has no direct S3 bucket policy or IAM permission granting access to the S3 path. What is the correct explanation and fix?

Accepted Answer

The S3 location must be registered with Lake Formation using a service role, allowing Lake Formation to vend temporary credentials so the analyst does not need direct S3 IAM permissions; verify the location registration and that Lake Formation credential vending is being used.

Answer

Lake Formation permissions never control S3 object access, so the analyst's IAM role must always be granted explicit s3:GetObject permissions on the bucket path in addition to the Lake Formation SELECT grant.

Answer

The analyst needs a KMS key policy update because Lake Formation cannot decrypt the S3 objects on the analyst's behalf under any circumstances.

Answer

SELECT permission in Lake Formation only applies to metadata in the Glue Data Catalog; a separate Lake Formation DATA_LOCATION_ACCESS grant on the S3 path is required for the analyst to read the objects.