DEA-C01 Practice Question 89: Lake Formation Register S3 Location
AWS Certified Data Engineer – Associate (DEA-C01) · Test 9 · question 9 of 10
A team stores curated data in an Amazon S3 path and catalogs it in the AWS Glue Data Catalog. Under its governance model, analysts' IAM roles deliberately have no direct Amazon S3 permissions, and access is granted with Lake Formation SELECT permissions on the tables. Analysts who have been granted SELECT still get access denied errors from Amazon S3 when they query the tables with Athena. What should the data lake administrator do?
Show answer and explanation
Answer:
When you register an Amazon S3 location, *"Lake Formation assumes that role when it grants temporary credentials to integrated AWS services that access the data in that location."* Lake Formation can only vend credentials for Athena for paths it manages. If the path is not registered, Lake Formation cannot supply access, and the analysts' roles have no S3 permissions of their own, so S3 denies the request. Registering the location, with the service-linked role or a custom role, lets Lake Formation permissions govern access (option D).
- A is wrong because it works around Lake Formation with direct S3 permissions, which breaks the governance model the team chose. - B is wrong because data location permissions control who can create Data Catalog resources that point to a location. They do not authorize reading the data. - C is wrong because versioning keeps multiple versions of objects and has no effect on how access is authorized.
Reference: Registering an Amazon S3 location