Analysts need column-level access control over a data lake in S3 — some columns (like salary) visible only to HR. Which service provides centralized, fine-grained data-lake permissions?
A.S3 bucket policies
Bucket policies control object-level access, not column granularity within data.
B.AWS Lake Formation
Correct. Lake Formation is the fine-grained data-lake governance service.
C.IAM policies on the objects
IAM on S3 operates at object level — you can't grant column-level rights on a file.
D.Amazon Macie
Macie discovers sensitive data; it doesn't enforce query-time permissions.
Why this answer
AWS Lake Formation provides centralized governance for data lakes — database/table/column-level (even row/cell-level) permissions enforced across Athena, Redshift Spectrum, and EMR consumers.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Data Governance practice session.
Practice Data Governance