AWS Certified Solutions Architect – Associate (SAA-C02) — Question 725

A company has an Amazon S3 data lake that is governed by AWS Lake Formation. The company wants to create a visualization in Amazon QuickSight by joining the data in the data lake with operational data that is stored in an Amazon Aurora MySQL database. The company wants to enforce column-level authorization so that the company's marketing team can access only a subset of columns in the database.
Which solution will meet these requirements with the LEAST operational overhead?

Answer options

• A. Use Amazon EMR to ingest the data directly from the database to the QuickSight SPICE engine. Include only the required columns.
• B. Use AWS Glue Studio to ingest the data from the database to the S3 data lake. Attach an IAM policy to the QuickSight users to enforce column-level access control. Use Amazon S3 as the data source in QuickSight.
• C. Use AWS Glue Elastic Views to create a materialized view for the database in Amazon S3. Create an S3 bucket policy to enforce column-level access control for the QuickSight users. Use Amazon S3 as the data source in QuickSight.
• D. Use a Lake Formation blueprint to ingest the data from the database to the S3 data lake. Use Lake Formation to enforce column-level access control for the QuickSight users. Use Amazon Athena as the data source in QuickSight.

Correct answer: D

Explanation

AWS Lake Formation natively supports column-level access control, which can be seamlessly applied to QuickSight users querying data through Amazon Athena. Using a Lake Formation blueprint provides the simplest, lowest-overhead method to ingest data from Amazon Aurora MySQL into the S3 data lake. Other methods, such as using IAM policies or S3 bucket policies, do not natively support granular column-level security filters, and using Amazon EMR introduces significant operational management overhead.