AWS Certified Data Analytics – Specialty — Question 26

A company leverages Amazon Athena for ad-hoc queries against data stored in Amazon S3. The company wants to implement additional controls to separate query execution and query history among users, teams, or applications running in the same AWS account to comply with internal security policies.
Which solution meets these requirements?

Answer options

• A. Create an S3 bucket for each given use case, create an S3 bucket policy that grants permissions to appropriate individual IAM users. and apply the S3 bucket policy to the S3 bucket.
• B. Create an Athena workgroup for each given use case, apply tags to the workgroup, and create an IAM policy using the tags to apply appropriate permissions to the workgroup.
• C. Create an IAM role for each given use case, assign appropriate permissions to the role for the given use case, and add the role to associate the role with Athena.
• D. Create an AWS Glue Data Catalog resource policy for each given use case that grants permissions to appropriate individual IAM users, and apply the resource policy to the specific tables used by Athena.

Correct answer: B

Explanation

The correct answer is B because creating an Athena workgroup allows for the separation of query execution and history by associating specific permissions through tags. Option A does not directly control query execution separation, while C focuses on IAM roles which do not inherently provide the required separation for query history. Option D pertains to Glue Data Catalog permissions, which are not directly related to the execution and history of Athena queries.