Question

A data engineering team has been managing access to their S3-based data lake entirely through IAM policies and S3 bucket policies. As the number of analysts and Glue Data Catalog tables grows, they want to centralize fine-grained (database, table, and column-level) permissions and maintain a single audit trail of who granted access to what. They enable AWS Lake Formation and register the S3 location. However, after granting a data analyst SELECT on a specific table through Lake Formation, the analyst can still query all tables in the S3 location via Athena. What is the MOST likely cause?

Accepted Answer

The IAMAllowedPrincipals default permission is still granted on the databases and tables, so Lake Formation is deferring to the analyst's existing IAM/S3 permissions.

Answer

Lake Formation column-level permissions do not take effect in Athena and require Redshift Spectrum instead.

Answer

The S3 location must be encrypted with a KMS key before Lake Formation permissions are enforced.

Answer

Athena does not support Lake Formation permissions and always uses the query executor's IAM role directly.