AWS Blog: Unified Access Control for Enterprise Lakehouses
This AWS Big Data Blog post details a solution for scaling fine-grained access control in enterprise lakehouses, addressing challenges like explosive dataset growth and multi-domain data ownership. It demonstrates how to combine AWS IAM Identity Center, AWS Lake Formation tag-based access control (TBAC), and trusted identity propagation in Amazon SageMaker Unified Studio. The architecture uses AWS CDK to classify data with LF-Tags, map IAM Identity Center groups to policies, and enforce permissions at query time for Apache Iceberg tables managed by AWS Glue Data Catalog.
- →Challenges in Enterprise Lakehouse Governance
- →Tag-Based Access Control (TBAC) for Scalable Governance
- →Reference Architecture for Unified Access Control
- →End-to-End Access Flow from User to Data
- →Hybrid RBAC + ABAC Governance Model
Notes (5) ›
- Challenges in Enterprise Lakehouse Governance
As lakehouses grow, managing fine-grained access control becomes complex due to explosive dataset growth, multi-domain data ownership, regional data sovereignty requirements, data sensitivity variations, and the operational overhead of manual table-level permissions in Lake Formation, leading to permission drift.
- Tag-Based Access Control (TBAC) for Scalable Governance
TBAC addresses governance challenges by applying policies based on resource tags rather than individual tables. New datasets inherit access rules through tag inheritance, and domain, region, and sensitivity tags enable multi-dimensional enforcement without role proliferation, improving scalability and auditability.
- Reference Architecture for Unified Access Control
The proposed architecture integrates AWS IAM Identity Center for identity management, Amazon SageMaker Unified Studio for unified analytics and ML access, and AWS Lake Formation for fine-grained, tag-based authorization. Two AWS Lambda functions automate tag assignment and permission provisioning via JSON configuration files.
- End-to-End Access Flow from User to Data
When a user queries data from SageMaker Unified Studio, their identity context is propagated through analytics services to Lake Formation. Lake Formation then evaluates LF-Tag policies against the user's IAM Identity Center group membership to dynamically grant or deny access at query time, ensuring consistent governance across different analytics engines.
- Hybrid RBAC + ABAC Governance Model
The governance model combines IAM Identity Center for user roles and group membership with Lake Formation LF-Tags for data classification. This hybrid approach allows IAM Identity Center to define who can request access and LF-Tags to define eligible datasets, enabling attribute-aware authorization and scalable governance that reduces administrative overhead.
https://aws.amazon.com/blogs/big-data/scaling-fine-grained-access-control-for-enterprise-lakehouse-using-sagemaker-unified-studio-and-aws-lake-formation/
Related releases
- AWS Glue integrates with SageMaker Unified Studio for one-click data access AWS What's New ·
- NVIDIA and Qwen AI Models Now on Amazon SageMaker JumpStart AWS What's New ·
- NVIDIA Nemotron 3.5 Lightning AI Model Now Available on Amazon SageMaker JumpStart AWS What's New ·
- New GLM-5.2 FP8, Nemotron-Nano-12B-v2, and GLM-OCR models on SageMaker JumpStart AWS What's New ·
- New AI Models from Redis, JetBrains, and LightOn Now on SageMaker JumpStart AWS What's New ·
- FLUX.2-small-decoder and gemma-4-12B-it Models Now on Amazon SageMaker JumpStart AWS What's New ·