Three subsidiaries need governed access to a central marketing data lake in S3 for campaign joins without copying raw tables, with column-level privacy and expiring access. Which data cataloging and cross-account sharing pattern enables secure governed discovery?

The governed pattern keeps raw tables in the central S3 lake while publishing Glue Data Catalog metadata for cross-account sharing through Lake Formation and RAM. LF-Tags enforce column-level privacy, and scheduled revocation provides expiring access for subsidiary campaign joins without duplicating data; for example, EventBridge Scheduler can call RevokePermissions because Lake Formation grants do not expire automatically. Replicating curated datasets to subsidiary accounts can retain Glue and Lake Formation controls, including column filtering, but violates the no-copy requirement and creates copies that must be synchronized and increase exposure. Sharing central Glue tables through RAM with time-limited IAM table-level grants supports centralized storage and expiration, but IAM alone does not provide the LF-Tag-based column filtering needed for privacy. Sharing through Lake Formation and RAM with LF-Tags but persistent grants supports in-place access and fine-grained control, yet leaves standing privileges instead of meeting the expiration requirement. As an exam caveat, distinguish sharing metadata and permissions from copying data: Lake Formation and RAM enable in-place cross-account queries, while replication or account-level copies move data. As a practical check, verify the cross-account principal, LF-Tag expression, and scheduled revocation in Lake Formation; then confirm from a subsidiary role that restricted columns are hidden, access expires as expected, and Athena queries run without local S3 copies.