DEA-C01 Practice Question 59: Lake Formation IAMAllowedPrincipals
AWS Certified Data Engineer – Associate (DEA-C01) · Test 6 · question 9 of 10
A team has adopted AWS Lake Formation on an account that already had AWS Glue Data Catalog databases and tables. A data lake administrator registered the S3 location and granted SELECT on only three columns of the customers table to the analyst role. Testing in Athena, the analyst can still see every column, including the ones that were withheld. The analyst's IAM policy grants broad glue:* and s3:GetObject access.
What is the most likely cause?
Show answer and explanation
Answer:
This is the classic backward-compatibility trap. "To maintain backward compatibility with AWS Glue, AWS Lake Formation has the following initial security settings: the Super permission is granted to the group IAMAllowedPrincipals on all existing AWS Glue Data Catalog resources" and "'Use only IAM access control' settings are enabled for new Data Catalog resources." The consequence is stated plainly: "These settings effectively cause access to Data Catalog resources and Amazon S3 locations to be controlled solely by AWS Identity and Access Management (IAM) policies. Individual Lake Formation permissions are not in effect." The analyst's broad glue:* and s3:GetObject policy is therefore what decides the outcome. The fix is to change the default settings for new resources and to revoke Super from IAMAllowedPrincipals on the existing databases and tables so Lake Formation permissions take effect.
Option A invents a caching problem. Lake Formation permissions are evaluated at query time, and MSCK REPAIR TABLE registers partitions; it has nothing to do with column grants.
Option B states a restriction that does not exist. Pre-existing tables can be governed by Lake Formation; they simply have to be upgraded out of the IAMAllowedPrincipals default first, which is the real issue here.
Option C describes a plausible-sounding failure with the wrong symptom. If credential vending were broken, queries would fail with access-denied errors rather than quietly returning more columns than were granted.