Skip to main content

Option A — Role-level (group-based) access

All users in the same Cognito group share the same IAM role and see the same data scope. There is no per-user filtering.

  • How it works: Cognito User Groups → IAM roles → table or database-level permissions via IAM policies or Lake Formation tags.
  • Best for: shared dashboards where entire departments access the same datasets (for example all finance analysts see all finance tables).

Complete Set up Amazon Cognito first. This page assumes you already have Cognito groups, each mapped to its own IAM role.

Choose how to scope each role​

You can isolate tables per group in either of two ways. Pick one.

Scope with IAM policies (no Lake Formation)​

Edit the permissions policy of each group's IAM role (from Cognito setup, Step 6) so that the GlueCatalogRead and S3DataRead statements list only the Glue databases, tables and S3 prefixes that group may read. For example, Athena-FinanceRole lists table/<database_name>/finance_* and the finance S3 prefix, while Athena-HRRole lists the HR tables and prefix.

This is the simplest option when your tables are already organized by department. Skip to Verify.

Scope with Lake Formation tags (TBAC)​

Use Tag-Based Access Control (TBAC) when you want to manage table access centrally in Lake Formation instead of in each IAM policy.

  1. Register your S3 locations. In the Lake Formation Console go to Data lake locations → Register location, register the S3 paths where your data resides (e.g. s3://my-athena-data-bucket/), and select the IAM role Lake Formation should use to access the data (or use the service-linked role).
  2. Set a Lake Formation admin. Under Administrative roles and tasks → Data lake administrators, add your admin IAM user or role.
  3. Create LF-Tags. Go to LF-Tags → Add LF-Tag and create tags that model your access dimensions, for example key Department with values finance, hr, engineering.
  4. Assign tags to databases and tables. Navigate to Data lake permissions → LF-Tags → select a database or table → Assign LF-Tag. For example, assign Department=finance to your finance tables.
  5. Grant permissions by tag. Go to Data lake permissions → Grant, select IAM users and roles → the IAM role for the Cognito group, choose LF-Tags as the resource, match the tag value for that group (e.g. Department=finance) and grant SELECT (and DESCRIBE).

Verify​

Sign in as a user from each group and run a simple SELECT against a table the group should and should not see. Users in finance_analysts see every row of the finance tables; tables granted only to hr_viewers are invisible to them, and vice versa. Everyone in the same group sees exactly the same data.

Next step​

Connect to Abacus.AI and use in ChatLLM.