How to best handle lake formation row level security from a shared IAM role

Question

We have a BI feature where a web app which uses non-aws authentication queries Athena for data which is hive partitioned by customer.  Currently any BI query gets modified to filter data down to just the partition that the user has access to, but we would like to migrate to using the new row level security with lake formation.

Since the backend is currently running under a single IAM role with access to all data, what is the best way to go forward with this?  Would we need to have a process that creates a LF filter for each customer/table combo, then create a IAM role for each customer and then grant the LF filters to each role and use STS to assume that customer role when invoking athena?

Is there an easier way with STS that can handle the filters and grants a little more dynamically without having to statically define each filter?

Satish_S · Answer

Create set of IAM roles based on user persona's and grant access to those data elements from Lake Foramtion to grant safer access to sensitive datasets. In turn those users can use same IAM role to create QuickSight or other dashboards using Athena as a soruce.

map these roles to on-prem AD group in case they are using Single-Sign-on.

Fabrizio@AWS · Answer

Currently, you need to define each filter via the console or the APIs , ad then assign the permissions to each Roles , as you mentioned.

An example implementation is describe in this blog post.

If your customers need access to the their full partition, you grant access only via that specific web-app, and there is no need for additional filters at rows or cell level, you may not need to go for row or cell filtering.

An example implementation is describe in [this blog post](https://aws.amazon.com/blogs/big-data/part-4-effective-data-lakes-using-aws-lake-formation-part-4-implementing-cell-level-and-row-level-security/).

If your customers need access to the their full partition, you grant access only via that specific web-app, and there is no need for additional filters at rows or cell level, you may not need to go for row or cell filtering.

How to best handle lake formation row level security from a shared IAM role

Relevant content