AWS Certified Data Engineer Associate DEA-C01 Practice Question

Your company maintains a multi-tenant data lake on Amazon S3 with each department's data stored under its own prefix (for example s3://company-data/finance/ and s3://company-data/hr/). Analysts run interactive queries in Amazon Athena through AWS IAM Identity Center. You must ensure an analyst can query only the objects in their department's prefix while minimizing ongoing configuration changes. Which approach applies role-based authorization and meets the requirement?

Tag all S3 objects with a Department key and use a single S3 Access Point whose policy allows access only when aws:ResourceTag:Department matches the analyst's tag, keeping one shared IAM role for every analyst.
Attach a bucket policy that denies GetObject unless the object key begins with the user's department prefix, and let all analysts continue to use the default IAM role provided by IAM Identity Center.
Generate pre-signed S3 URLs for each department's query results at the start of every Athena session and distribute them to analysts through AWS Secrets Manager.
Create an IAM role for each department that allows access only to its S3 prefix, register the prefix with AWS Lake Formation using that role, grant the role SELECT permissions on the relevant tables, and require analysts to assume their department's role before running Athena queries.

Report Issue

Answer Description

Creating one IAM role per department, limiting the role's S3 permissions to the department prefix, and registering that prefix with AWS Lake Formation provides role-based authorization. When an analyst assumes the role, Lake Formation vends temporary, scoped-down credentials to Athena, so queries outside the allowed prefix are automatically denied without additional bucket or object changes. The other options rely on tag-based ABAC, broad bucket policies, or pre-signed URLs; none of those implements true role-based access and each introduces more maintenance or looser control.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.