Question

A data engineering team is adopting AWS Lake Formation to govern a data lake stored in Amazon S3. The team's Glue ETL jobs run under an IAM role that already has S3 bucket permissions granted through IAM policies, but analysts querying the same tables through Athena report 'Insufficient Lake Formation permission' errors even though they have been granted SELECT via Lake Formation. What must the team do so that Lake Formation permissions are actually enforced and honored for the S3 data location?

Accepted Answer

Register the S3 location with Lake Formation using a registered role, and remove the broad IAM S3 permissions that bypass Lake Formation enforcement.

Answer

Attach an S3 bucket policy that grants s3:GetObject to the analysts' IAM roles so Athena can read the underlying objects.

Answer

Enable default encryption with a KMS key on the S3 bucket and grant the analysts kms:Decrypt permission.

Answer

Add the analysts to the Lake Formation data lake administrators list so their SELECT grants take effect.