Troubleshooting Lake Formation Column-Level Security: IAM Role Bypass
A data engineering team uses AWS Glue Data Catalog to manage metadata for datasets in Amazon S3. The datasets contain personally identifiable information (PII). The team needs to implement column-level security so that only authorized users can access columns with PII. They use Amazon Athena for querying. The team has enabled AWS Lake Formation and defined data lake locations. They have created a Lake Formation tag called 'PII' and assigned it to the columns containing PII. They have also granted 'SELECT' permission on those columns to a specific IAM role. However, when a user assumes that role and queries the table using Athena, they can still see all columns, including the PII columns. What is the most likely cause?
Quick Answer
The answer is that the IAM role bypasses Lake Formation column-level security because it has direct IAM permissions to the S3 data rather than relying on Lake Formation permissions. Lake Formation acts as a centralized access control layer, and when an IAM role holds direct S3 GetObject or ListBucket permissions, it can read the underlying Parquet or CSV files without consulting Lake Formation’s tag-based policies, effectively ignoring the PII column restrictions. On the AWS Certified Data Engineer Associate DEA-C01 exam, this scenario tests your understanding that Lake Formation security only applies when the table is registered as a data lake location and the principal has Lake Formation grants—not just IAM S3 access. A common trap is assuming that applying tags and granting SELECT in Lake Formation is sufficient, but if the role can access S3 directly, it will bypass Lake Formation entirely. Memory tip: “Lake Formation first, S3 last”—always check that the IAM role lacks direct S3 permissions before troubleshooting column-level security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IAM role does not have the necessary Lake Formation permissions; it only has IAM permissions to the S3 data.
Lake Formation column-level security requires that the table be registered as a data lake location in Lake Formation and that the IAM role has Lake Formation permissions, not just IAM permissions. The IAM role might be bypassing Lake Formation if it has S3 permissions directly. Option A is wrong because the tags are applied correctly. Option B is wrong because the S3 bucket policy should not allow direct access; Lake Formation should be the access point. Option D is wrong because disabling encryption would not cause this issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The data in S3 is not encrypted, so Lake Formation cannot enforce column-level security.
Why it's wrong here
Encryption is not a prerequisite for column-level security.
- ✗
The S3 bucket policy grants direct access to the IAM role, bypassing Lake Formation.
Why it's wrong here
Lake Formation should be the only access control; direct S3 access would bypass it.
- ✓
The IAM role does not have the necessary Lake Formation permissions; it only has IAM permissions to the S3 data.
Why this is correct
Lake Formation column-level security requires that the principal has Lake Formation 'SELECT' permission on the table and columns, and that the principal does not have direct S3 access.
- ✗
The Lake Formation tag 'PII' is not properly associated with the columns.
Why it's wrong here
The tag is assigned, so that is not the issue.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using AWS Glue to catalog data in S3. The security team wants to ensure that only authorized users can access the Glue Data Catalog and that data lineage is tracked. Which AWS services can be used together to meet these requirements? (Choose TWO.)
easy- A.AWS CloudTrail
- ✓ B.AWS Glue DataBrew
- C.Amazon Athena
- ✓ D.AWS Lake Formation
- E.Amazon Kinesis
Why B: Options B and D are correct. AWS Lake Formation provides fine-grained access control for the Glue Data Catalog, and AWS Glue DataBrew offers data lineage visualization. Option A is incorrect because CloudTrail logs API calls but does not manage permissions or access control. Option C is incorrect because Athena is a query service, not for access control or lineage. Option E is incorrect because Kinesis is for streaming data.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.