Redshift Spectrum Access to Lake Formation
My customer is looking to provide fine-grained access from Redshift Spectrum to data governed by Lake Formation. They are wondering how access can be controlled and if this can be done through users in Redshift or if this can only be done via IAM. From the various documentation I have looked at, it appears that you can only modify the policy on the Redshift cluster to access the data and that individual users cannot be restricted further.
Documentation I've read through: https://docs.aws.amazon.com/lake-formation/latest/dg/tut-query-redshift.html https://docs.aws.amazon.com/redshift/latest/dg/r_REVOKE.html
You can add multiple roles to a Redshift cluster (up to 10 per clusters), and in Amazon Lake formation you could assign different permission sets to each of these 10 roles. Back in Redshift you could create a different External Schema for each role pointing to the same Catalog in Lake Formation, and then assign USAGE privilege on the different External schemas to the various users (or better groups) depending on the permission you want to assign them; this should allow you to "partially" implement a user access strategy in Redshift as well.
Redshift Spectrum Access to Lake FormationAccepted Answerasked 3 years ago
use Redshift Spectrum to query both Redshift table and s3 fileAccepted Answerasked 2 years ago
Is it possible to specify DB snapshot in AWS Lake Formation?Accepted Answerasked a year ago
Access error : Spark query from AWS EMR with AWS Lake Formationasked 5 months ago
Distinguish Redshift Spectrum from Redshift CostsAccepted Answerasked 4 years ago
Is it possible to have a Redshift Spectrum schema access multiple accounts data ?asked 3 months ago
Redshift Managed Storage vs SpectrumAccepted Answerasked 2 years ago
How to best handle lake formation row level security from a shared IAM roleasked 7 months ago
Cross account access from Athena to S3Accepted Answerasked 3 years ago
Redshift Spectrum giving IERR_READ_ERROR (Access Denied) errorasked 3 years ago