Lake Formation: Column-Level Permissions on a Data Lake Table
Move a table from IAM-only access to Lake Formation governance. You become a data lake admin, register the S3 location, revoke the default IAMAllowedPrincipals grant and give analysts SELECT on every column except email and SSN.
Level: Intermediate · Time: about 55 minutes · Region: us-east-1
AWS services you'll use
- Lake Formation
- Glue
- Athena
- IAM
What you'll do in this lab
- Become a data lake administrator
- Register the location and switch the table to Lake Formation
- Grant column-filtered access to analysts
- Query as the analyst
- Verify the solution end to end
Each task is checked against your live AWS account. Step-by-step instructions, hints and verification unlock when you start the lab.
Before you start
- Comfortable with S3, IAM roles and SQL
- Basic Python for reading Lambda and PySpark code
How the lab works
- Get a real, temporary AWS account locked to one region. No AWS account of your own needed.
- Build in the real AWS console with a guide beside it, and hints when you are stuck.
- Verify every task: we check the resources in your live account.
- Automatic cleanup: everything is deleted when you stop, and nothing is billed to you.
Questions about this lab
Do I need my own AWS account?
No. When you start the lab, Cloud Arena gives you a real, temporary AWS account with its own login, locked to one region. You work in the real AWS Management Console, not a simulator.
Will AWS charge me anything?
No. Cloud Arena pays for the AWS resources, and everything you create is deleted automatically when you stop the lab or the session ends. Nothing is billed to you by AWS.
How long does the Lake Formation: Column-Level Permissions on a Data Lake Table lab take?
Plan for about 55 minutes. The session timer is shown on screen, and every task is checked against your live AWS account when you click Verify.
How do I get access to this lab?
It is included in the AWS Certified Data Engineer – Associate plan: a one-time payment for every lab in the path, 2 attempts per lab and a 7-day money-back guarantee. You can also start with the 5 free labs.
Does this lab help with the Data Engineer – Associate (DEA-C01) exam?
Yes. It is part of the AWS Certified Data Engineer – Associate path, which covers the hands-on skills behind the exam. Doing the task in a real account is what makes the questions easier to reason about.
Related AWS labs
- Detect and Redact PII in a Glue ETL Job
- Kinesis Data Streams: Lambda Consumer, Batching and Enhanced Fan-Out
- Amazon Data Firehose to S3: Parquet Conversion and Dynamic Partitioning
- Glue Crawler and Data Catalog: Query Partitioned Data with Athena
- Glue ETL: Convert CSV to Partitioned Parquet with Job Bookmarks
- Glue DataBrew: Profile and Clean a Messy Dataset Without Code