A lake has hundreds of databases/tables. Teams should get access based on DATA CLASSIFICATION (e.g., 'confidentiality=internal') without granting table-by-table. Which Lake Formation mechanism scales this?
A.Named resource grants per table
Per-object grants = policy explosion at scale.
B.LF-Tags — tag the catalog resources, grant on tag expressions
Correct. Attribute-based, auto-scaling access control.
C.IAM groups per table
IAM groups can't express lake-table granularity well.
D.Bucket policies
Bucket policies are object-level — no table semantics.
Why this answer
LF-Tags (tag-based access control, TBAC) assign attributes to catalog objects and grant permissions on tag expressions — new resources inherit access by tags, so policies scale with classification, not enumeration. Named grants don't scale to hundreds of objects.
Correct answer: B · Last reviewed 2026-11-04
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Data Governance practice session.
Practice Data Governance