Users and their data: Modern access and audit patterns on AWS
summary
Shows how AWS implements trusted identity propagation so end users authenticate through IAM Identity Center and their exact identity reaches EMR, Athena, Glue/Lake Formation and S3. Demonstrates grants in Lake Formation and S3 Access Grants that enforce per-table and per-prefix access, writes per-user Athena output folders, and yields CloudTrail events that attribute GetObject/PutObject to the user (not just a cluster role). Includes a working EMR Studio notebook flow and a Q Business demo that successfully respects those identity-based controls.
AI-written summary · about
chapters (9)
- 0:00Welcome and data foundation
- 7:48Trusted identity propagation
- 13:24IAM vs fine-grained access
- 21:28Deep dive on Lake Formation
- 32:26Demo with EMR Studio
- 41:39IAM roles in identity flow
- 45:35S3 Access Grants explained
- 49:38Generative AI and data access
- 52:29Summary and key takeaways
related talks
28mYour journey to temporary credentials in the cloud
57mA first-principles approach: AWS Identity and Access Management (IAM)
13mSimplifying data security in a complex data lake environment
18mSecuring PHI in the cloud: Best practices in AWS environments
01h 00mAWS Identity Workshop
10mDemystifying Access Control in the Modern Data Warehouse
28mIdentity Services on AWS
25mGetting started with AWS Identity Services