AWS Lake Formation

AWS Lake Formation builds and secures data lakes on AWS, providing centralised permissions that are enforced consistently across the analytics services reading the data, including table, column and row-level access control over data held in S3 and catalogued in the Glue Data Catalog.

Centralised permissions are the actual product and they solve a problem that grows quietly. A data lake accessed by several engines otherwise needs its access rules expressed once per engine, and those definitions drift, so a column restricted in one query tool remains visible through another.

Column and row level control is what makes a shared lake usable for sensitive data. Without it the only options are giving a team the whole table or copying a filtered version for them, and copies are where governance quietly fails because nobody updates the restriction on the copy.

The trade is depth of integration against portability. These permissions are enforced by AWS services reading the data, so the model works well inside that estate and does not travel to engines outside it, which is worth establishing before treating it as the governance layer for everything. An organisation querying the same lake from a tool outside AWS still needs its rules expressed there too.