A data-mesh team must grant a second AWS account SELECT access to specific tables in its data lake — with the same fine-grained (table/column) permissions Lake Formation enforces. How is this done?
A.Share the S3 bucket policy with the external account
Bucket policies grant object-level access — no column governance.
B.Lake Formation cross-account grants shared via AWS RAM, with permissions enforced in the consumer account's catalog
Correct. RAM share + LF permission model preserved cross-account.
C.Copy the Glue Data Catalog to the second account
Catalog copies drift and carry no permission semantics.
D.Give the second account's users IAM roles in the first account
IAM roles grant coarse access and complicate governance.
Why this answer
Lake Formation's cross-account model shares databases/tables to external accounts via AWS Resource Access Manager — the consumer accepts the share and Lake Formation permissions (including column-level) apply there too. Bucket policies alone bypass the fine-grained governance layer.
Correct answer: B · Last reviewed 2026-11-02
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Data Governance practice session.
Practice Data Governance