Question

A data engineering team stores curated datasets in an S3 data lake organized by department prefixes (e.g., s3://corp-lake/finance/, s3://corp-lake/marketing/). The company has thousands of employees synchronized from an external corporate identity provider into IAM Identity Center. Business analysts should be granted read access to only their department's prefix, and access should map directly to their corporate directory group membership. The current approach of editing a single S3 bucket policy has grown unmanageable and is approaching the bucket policy size limit. Which solution provides scalable, identity-based access mapping with the LEAST ongoing policy maintenance?

Accepted Answer

Use S3 Access Grants to map corporate directory groups from IAM Identity Center to specific S3 prefixes, issuing temporary credentials scoped to each grant.

Answer

Create one IAM role per department with an inline policy limiting access to the department prefix, and have analysts assume the appropriate role.

Answer

Continue using the bucket policy but split it across multiple buckets, one per department, each with its own policy referencing directory groups.

Answer

Register the data lake with Lake Formation and grant table-level permissions to each analyst individually based on their department.