AWS Certified Solutions Architect – Associate (SAA-C03) — Question 298

A company has an Amazon S3 data lake that is governed by AWS Lake Formation. The company wants to create a visualization in Amazon QuickSight by joining the data in the data lake with operational data that is stored in an Amazon Aurora MySQL database. The company wants to enforce column-level authorization so that the company’s marketing team can access only a subset of columns in the database.

Which solution will meet these requirements with the LEAST operational overhead?

Answer options

• A. Use Amazon EMR to ingest the data directly from the database to the QuickSight SPICE engine. Include only the required columns.
• B. Use AWS Glue Studio to ingest the data from the database to the S3 data lake. Attach an IAM policy to the QuickSight users to enforce column-level access control. Use Amazon S3 as the data source in QuickSight.
• C. Use AWS Glue Elastic Views to create a materialized view for the database in Amazon S3. Create an S3 bucket policy to enforce column-level access control for the QuickSight users. Use Amazon S3 as the data source in QuickSight.
• D. Use a Lake Formation blueprint to ingest the data from the database to the S3 data lake. Use Lake Formation to enforce column-level access control for the QuickSight users. Use Amazon Athena as the data source in QuickSight.

Correct answer: D

Explanation

Using AWS Lake Formation blueprints simplifies the ingestion of database tables into Amazon S3 with minimal configuration. Lake Formation natively supports column-level permissions, which can be directly enforced when Amazon Athena is used as the query engine for Amazon QuickSight. Other options, such as managing Amazon EMR or trying to enforce column-level security using IAM or S3 bucket policies, introduce significant operational overhead and are less secure.