Redshift Spectrum Access to Lake Formation
My customer is looking to provide fine-grained access from Redshift Spectrum to data governed by Lake Formation. They are wondering how access can be controlled and if this can be done through users in Redshift or if this can only be done via IAM. From the various documentation I have looked at, it appears that you can only modify the policy on the Redshift cluster to access the data and that individual users cannot be restricted further.
Documentation I've read through: https://docs.aws.amazon.com/lake-formation/latest/dg/tut-query-redshift.html https://docs.aws.amazon.com/redshift/latest/dg/r_REVOKE.html
You can add multiple roles to a Redshift cluster (up to 10 per clusters), and in Amazon Lake formation you could assign different permission sets to each of these 10 roles. Back in Redshift you could create a different External Schema for each role pointing to the same Catalog in Lake Formation, and then assign USAGE privilege on the different External schemas to the various users (or better groups) depending on the permission you want to assign them; this should allow you to "partially" implement a user access strategy in Redshift as well.
Relevant questions
Redshift Spectrum Access to Lake Formation
Accepted Answerasked 3 years agouse Redshift Spectrum to query both Redshift table and s3 file
Accepted Answerasked 2 years agoIs it possible to specify DB snapshot in AWS Lake Formation?
Accepted Answerasked a year agoAccess error : Spark query from AWS EMR with AWS Lake Formation
asked 5 months agoDistinguish Redshift Spectrum from Redshift Costs
Accepted Answerasked 4 years agoIs it possible to have a Redshift Spectrum schema access multiple accounts data ?
asked 3 months agoRedshift Managed Storage vs Spectrum
Accepted Answerasked 2 years agoHow to best handle lake formation row level security from a shared IAM role
asked 7 months agoCross account access from Athena to S3
Accepted Answerasked 3 years agoRedshift Spectrum giving IERR_READ_ERROR (Access Denied) error
asked 3 years ago