By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Working with large image files in Lake Formation

0

I need to use Lake Formation LF-TAG permissions to control access to a group of large [image] files stored in S3. I created a governed table in Lake Formation to keep all image metadata, including S3 path to images itself. I configured LF-TAGs tags to provide a restricted user with access to this metadata table and its content.

However, I can't figure out how to configure LF-TAG permissions to control access to image objects (files) located in S3 . It is possible to use LF-TAGs to control access to non-tabular data at all>

Topics
StorageSecurity, Identity, & ComplianceAnalytics
Tags
Amazon Simple Storage ServiceSecurity, Identity, & ComplianceAWS Identity and Access ManagementAWS Lake Formation
Language
English
Stas Khirman
asked a year ago368 views
1 Answer
0
Accepted Answer

So I would answer this by you are trying to leverage LF-TBAC to control access to files in S3. This is where I would look into the specifics on how to provide granular access to objects/files/prefixes within S3 specifically.

Here is a specific workshop that you could potentially use to find a method to do it. https://catalog.workshops.aws/applying-abac/en-US/module1/01architecture if it works out, I think that would be a great blog item to talk about!

Please let me know if this answer provided you some benefit by marking it as accepted, and do come back to see if you found a way to unite S3 ABAC to LF-TBAC.

profile picture
D G
answered a year ago
  • Stas Khirman
    a year ago

    Hi D.G.

    Thank you for a prompt response - this a cool idea to combine LF-TRAC and ABAC. I'll try to implement a small POC and share my solution with you.

    However, I just wonder if Lake Formation implement something similar - IMHO my use case is quite a standard one.

    Thank you Stas

  • D G
    a year ago

    Yeah I think you could somehow "merge" the tag application so from an IAM perspective least privilege is attained, but on the LF-TBAC the object level is also provided. Think of it like a ABAC sandwich between IAM and LF.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content