Multiple city departments share one Amazon S3 data lake, but police, parks, and finance each need different column- and table-level permissions for sensitive datasets. Which AWS capability is best suited to govern that fine-grained lake access?
Select an answer to reveal the explanation.
Short Explanation
A shared lake without a librarian turns into a free-for-all. Lake Formation is that librarian—central, fine-grained rules so police, parks, and finance each see what they’re allowed to see. Public ACLs, wide-open bucket policies, or Macie-only discovery don’t replace governed lake permissions.
Full Explanation
AWS Lake Formation is best suited to govern fine-grained column- and table-level permissions across a multi-department Amazon S3 data lake because it centralizes lake permissions for engines that integrate with the Glue Data Catalog, letting police, parks, and finance receive different access to sensitive municipal datasets without handing every team raw bucket-wide rights. Public ACLs on every object combined with a shared IAM user password emailed to directors violate least privilege, destroy auditability, and cannot express column-level SQL controls. A single S3 bucket policy that grants s3: to Principal "" is an open-bucket anti-pattern that exposes the entire lake. Amazon Macie alone as the only access-control system is the wrong tool category: Macie discovers and classifies sensitive data; it does not replace a permission governance plane for Athena/Redshift Spectrum-style access. Exam caveat: Lake Formation works with registered locations and LF-Tags/permissions; you still need sound IAM for administrative principals and should not confuse Macie findings with grant decisions. Operational check: register the lake locations, grant department-specific LF permissions on tables/columns, verify each persona’s Athena query succeeds only on allowed fields, and confirm denied queries appear in audit logs during an access review.