Data Security and Governance Study Guide — DEA-C01

Data Security and Governance

This domain accounts for 18% of the AWS DEA-C01 exam — roughly 12–13 questions. It tests your ability to design and implement security controls, access policies, encryption strategies, data governance frameworks, and compliance patterns for AWS data engineering workloads. Expect scenario-based questions that require you to choose the most appropriate AWS service or configuration for a given security requirement, often with two plausible options that differ by a single architectural detail.

AWS Lake Formation: Fine-Grained Column and Row-Level Security

AWS Lake Formation is the central governance layer for data lakes on AWS. It sits on top of the AWS Glue Data Catalog and enforces permissions at the database, table, column, and row levels for services that integrate with it (Athena, Redshift Spectrum, EMR, Glue ETL).

Key Concepts

• Lake Formation permissions are granted on Catalog resources (databases, tables, columns) in addition to IAM policies. Both must allow access for a principal to succeed.
• Column-level security: Grant or revoke SELECT on specific columns. You can explicitly exclude columns using the "Exclude columns" option when granting table-level access.
• Row-level security (RLS): Implemented via data filters (also called row-level security filters). A data filter defines a row filter expression (SQL WHERE clause equivalent) and optionally included/excluded columns. Filters are attached to principals per table.
• Tag-based access control (LF-TBAC): Assign LF-Tags to Catalog resources and grant permissions on tag key-value pairs rather than individual tables. Scales better than resource-based grants for large catalogs.
• Registered S3 locations: Lake Formation manages access to registered S3 paths. A service-linked role (AWSServiceRoleForLakeFormationDataAccess) is used to vend temporary credentials to query engines.

Common Traps

• IAM alone cannot enforce column or row-level security on Glue Catalog tables. If the question asks for column/row control, Lake Formation is required.
• Lake Formation permissions are additive with IAM — both must allow; Lake Formation cannot override an IAM deny.
• Granting ALL columns then excluding sensitive ones is different from explicitly listing allowed columns. Understand the "exclude columns" pattern.
• The Super permission in Lake Formation gives full access to a database/table — avoid granting it unintentionally.
• LF-TBAC requires LF-Tags to be assigned before grants; forgetting the tag assignment is a common misconfiguration.

Worked Scenario

Requirement: A data lake has a customers table with a ssn column. Analysts should query all columns except ssn. Administrators should see everything.

Reasoning: Create a Lake Formation grant for the analyst role on the customers table using "Exclude columns" to exclude ssn. Grant the admin role SELECT on all columns including ssn. No IAM changes are needed beyond allowing Athena execution. Row-level filters are not required here — this is column exclusion only.

AWS Glue Data Catalog: Resource Policies and Cross-Account Access

The AWS Glue Data Catalog is a metadata repository. It is regional and account-scoped by default.

• Resource policies: Attach a JSON resource-based policy to the Catalog itself (not individual databases/tables). Policies control API-level access (glue:GetTable, glue:CreateDatabase, etc.).
• Cross-account access patterns:
  1. Direct Glue resource policy: Grant another account's principal access to Catalog resources. The external account's IAM must also allow the Glue actions.
  2. Lake Formation + AWS RAM: Share Catalog databases/tables via Resource Access Manager. The receiving account accepts the RAM share, then sees the resources in their own Catalog. This is the preferred pattern for governed cross-account data lake sharing.
• Catalog encryption: Enable metadata encryption (SSE with AWS KMS) and connection password encryption separately — they are two distinct settings.

Common Traps

• A Glue resource policy controls Catalog API access, not data access on S3. You still need S3 bucket policies for the underlying data.
• When using Lake Formation cross-account sharing, the data location (S3) must also grant access — Lake Formation handles Catalog permissions but not S3 bucket policy automatically.
• glue:GetTable succeeds only if both the Glue resource policy (if one exists) and IAM allow it.