Free AWS MLA-C01 Actual Exam Questions - Question 8 Discussion
structured data and unstructured dat
a. The company's ML engineers are assigned to specific advertisement campaigns.
The ML engineers must interact with the data through Amazon Athena and by browsing the data
directly in an Amazon S3 bucket. The ML engineers must have access to only the resources that are
specific to their assigned advertisement campaigns.
Which solution will meet these requirements in the MOST operationally efficient way?
Adeel M.: A imo—IAM policies on Glue catalog directly control Athena queries without extra S3 policy complexity.
It’s C—Lake Formation handles both S3 and Athena access in one place efficiently.
A doesn’t fully solve the problem since it only restricts Athena queries but not direct S3 access. The engineers need permissions on both, so A alone isn’t enough.
C/D? C makes sense for unified control, but D could be simpler if the S3 folders are well organized by campaign. Still, D alone won’t cover Athena access properly.
Option B could work by dynamically updating S3 bucket policies based on campaign assignments, but it feels more complex and less operationally efficient than using Lake Formation tags to handle access directly.
A doesn’t seem to cover S3 access properly since IAM policies on Glue Data Catalog mainly control Athena queries, not direct S3 browsing. The ML engineers need to access both, so just restricting Athena isn’t enough. Plus, managing individual IAM policies for every campaign and user would get messy fast. C looks more operationally efficient because Lake Formation tags can unify permissions for both Athena and S3, making it simpler to enforce campaign-specific access without a lot of custom policy work.
C seems best since Lake Formation tags can control both Athena and S3 access efficiently.
Does the question specify if the ML engineers' access needs to be controlled at the object level inside the S3 bucket, or just at the database/table level in Athena? That might affect whether Lake Formation tag-based access (option C) or bucket policies (option D) is best.