Analysts should query a data lake table but only see non-sensitive columns — salary and SSN must be hidden. Which approach enforces column-level access centrally?
A.S3 bucket policy denying access to specific objects
Columns live inside files — bucket policies can only control whole objects.
B.Lake Formation column-level permissions on the catalog table
Correct. Lake Formation column filters let you grant SELECT on named columns only.
C.IAM policy with a Condition on column names
IAM has no knowledge of table columns; conditions cover API-level attributes.
D.Encrypting the sensitive columns client-side
Client-side encryption hides data but breaks analytics on those columns entirely — access control is the requirement.
Why this answer
Lake Formation grants column-level (and row-level) permissions on Data Catalog tables — services like Athena enforce them at query time. IAM and bucket policies operate at the object/bucket level and can't see column semantics.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Data Governance practice session.
Practice Data Governance