By using AWS re:Post, you agree to the Terms of Use
/Redshift Spectrum Access to Lake Formation/

Redshift Spectrum Access to Lake Formation

0

My customer is looking to provide fine-grained access from Redshift Spectrum to data governed by Lake Formation. They are wondering how access can be controlled and if this can be done through users in Redshift or if this can only be done via IAM. From the various documentation I have looked at, it appears that you can only modify the policy on the Redshift cluster to access the data and that individual users cannot be restricted further.

Documentation I've read through: https://docs.aws.amazon.com/lake-formation/latest/dg/tut-query-redshift.html https://docs.aws.amazon.com/redshift/latest/dg/r_REVOKE.html

1 Answers
0
Accepted Answer

You can add multiple roles to a Redshift cluster (up to 10 per clusters), and in Amazon Lake formation you could assign different permission sets to each of these 10 roles. Back in Redshift you could create a different External Schema for each role pointing to the same Catalog in Lake Formation, and then assign USAGE privilege on the different External schemas to the various users (or better groups) depending on the permission you want to assign them; this should allow you to "partially" implement a user access strategy in Redshift as well.

EXPERT
answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions