A municipal data lake account must share a Glue Data Catalog with analytics accounts so analysts can query curated tables without copying datasets or handing out access keys. Which design best provides least-privilege cross-account data access?
Select an answer to reveal the explanation.
Short Explanation
Sharing the catalog is like giving library cards for specific shelves, not photocopying the whole library and taping a master key to each copy. Lake Formation (with cross-account share patterns) lets analytics accounts use curated tables under least privilege. Emailing dumps with keys, world-readable buckets, or turning off encryption are shortcuts that blow past governance.
Full Explanation
Cross-account analytics access should grant permissions on Glue Data Catalog databases and tables—and the underlying S3 data locations—without duplicating data or distributing long-lived keys. AWS Lake Formation supports governed sharing across accounts, often coordinated with AWS Resource Access Manager patterns, so consumer accounts receive least-privilege access. Public buckets, emailed credential bundles, or disabling encryption trade convenience for uncontrolled exposure and fail municipal data-governance expectations.