Lake Formation
Access control for the data lake, written as grants on the catalog instead of IAM policies on S3 paths. Lake Formation itself is free.
Engines ask Lake Formation. Users never hold S3 access.
From one table to a whole domain.
Named grants
SELECT, DESCRIBE, ALTER on a database, a table or columns. Simple, but one grant per resource.
LF-Tags
Tag resources once (domain=finance) and grant on the tag. New tables with the tag are already covered.
Data filters
Row, column and cell rules as named filters on a table, instead of one view per audience.
Cross-account sharing uses the same grants, delivered through AWS RAM with no copy of the data.
What decides whether it actually enforces.
Grant by name or by tag
Named grants multiply with every table and role. LF-Tags keep the number of grants tied to your domains.
How you switch it on
Start in hybrid mode and move teams one at a time. Enforcement really starts when the default IAMAllowedPrincipals grant is revoked.
Which engines apply it
Check the support matrix for the granularity you need before promising row or cell filters on every engine.
The grant bars are illustrative shapes.
A Lake Formation bill, in one line.
Agentic analytics
Business teams ask your data in plain language. Context and evaluation decide whether they can trust the answer.
Read the approach →The one-page Lake Formation field guide.
Best practices, cost traps and performance checks, in the order you should run them. Printable, no fluff.