Preventing IAM Policy Bypass of Lake Formation Permissions
A healthcare organization uses AWS Lake Formation to manage a data lake in Amazon S3. The data lake contains sensitive patient information that must be encrypted at rest. The organization uses AWS KMS with a customer-managed key (CMK) for encryption. Recently, the security team noticed that a new IAM user was able to query the data lake using Amazon Athena without explicit permissions in Lake Formation. The data lake administrator suspects that the IAM user might have been granted access through an IAM policy that allows 'lakeformation:GetDataAccess' without proper resource restrictions. The organization wants to enforce that only Lake Formation permissions control access to the data lake, and IAM policies should not grant access directly. What should they do?
Quick Answer
The correct answer is to revoke the `lakeformation:GetDataAccess` permission from all IAM users and groups, ensuring that access is granted only through Lake Formation permissions. This is because `lakeformation:GetDataAccess` is the specific IAM action that allows a principal to bypass Lake Formation’s fine-grained access controls and directly query the data lake via services like Athena; removing it from all IAM policies forces every user to rely solely on Lake Formation’s own permission model. On the AWS Certified Data Engineer Associate DEA-C01 exam, this scenario tests your understanding of the principle of least privilege and the separation of duties between IAM and Lake Formation—a common trap is thinking that restricting a single user or using S3 bucket policies is sufficient, but only revoking the action globally prevents any IAM-based bypass. Remember the memory tip: “GetDataAccess gets you in—remove it to keep Lake Formation in control.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Revoke the 'lakeformation:GetDataAccess' permission from all IAM users and groups, and require that access be granted only through Lake Formation permissions.
Revoking the 'lakeformation:GetDataAccess' permission from all IAM users and groups ensures that only Lake Formation permissions control access to the data lake. This prevents IAM policies from bypassing Lake Formation's fine-grained access control. Option A is wrong because changing the KMS key policy would not address the IAM policy issue; KMS controls encryption, not access permissions. Option C is wrong because removing the policy from a single user does not prevent other users from having similar permissions; a broader revocation is needed. Option D is wrong because S3 bucket policies would still allow direct S3 access, bypassing Lake Formation's controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the KMS key policy to require that any request to decrypt data must come from the Lake Formation service role.
Why it's wrong here
KMS key policies do not control access to Lake Formation resources.
- ✓
Revoke the 'lakeformation:GetDataAccess' permission from all IAM users and groups, and require that access be granted only through Lake Formation permissions.
Why this is correct
This ensures that only Lake Formation permissions control data access.
- ✗
Remove the IAM policy that grants 'lakeformation:GetDataAccess' from the specific user and ensure Lake Formation permissions are correctly set.
Why it's wrong here
This only addresses one user; other users might still have similar IAM policies.
- ✗
Add an S3 bucket policy that denies all principals except the Lake Formation service role.
Why it's wrong here
This would break legitimate access through Lake Formation and is not a scalable solution.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A data engineer runs an AWS Glue ETL job that reads from a table in the AWS Glue Data Catalog. The job fails with the error shown. The IAM role used by the Glue job has the following policy attached: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:GetTable", "glue:GetDatabase" ], "Resource": "*" } ] } What should be added to the IAM role's policy to resolve the error?
hard- A.s3:GetObject on the underlying S3 bucket
- B.glue:GetTable on the specific table resource
- ✓ C.lakeformation:GetDataAccess on the table resource
- D.kms:Decrypt on the KMS key
Why C: Lake Formation requires lakeformation:GetDataAccess permission on the table. Option A is wrong because the error is about Lake Formation, not S3. Option B is wrong because the role already has glue:GetTable. Option D is wrong because kms:Decrypt is not indicated.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.