Morningstar faced challenges with centralized data management and entitlements across their data lake and Amazon Redshift. They implemented a tag-based permissions system in Lake Formation to simplify entitlements management. They then created an in-house mapper to translate the tag-based Lake Formation grants and revokes to equivalent resource-based grants and revokes in Amazon Redshift. This provided a consistent permissions approach across both systems and enabled faster data access, more automation and self-service of permissions.

1. <@your social handle>

2. Streamlined Entitlements with AWS
Lake Formation: A Complete Guide to
Centralized Data Management
Anusha Dwivedula
Director, EnterpriseData & Platform,
Morningstar

3. ➢ Overview of business challenges around data
➢ Morningstar’s data platform in AWS
➢ Lakeformation Entitlements Simplified With Tag-Based
➢ In-house implementation to solve the entitlements problem in Redshift
➢ Business impact and value
Goal

4. Centralizing Data – Business Problem

5. Centralizing Data – Data Lake Architecture

6. Lakeformation Entitlements Simplified With Tag-Based
GRANT CREATE_TABLE ON Database A TO PRINCIPAL1
GRANT SELECT,INSERT ON Table A.1 TO PRINCIPAL 1
GRANT SELECT,INSERT ON Table A.2 TO PRINCIPAL 1
GRANT SELECT,INSERT ON Table B.2 TO PRINCIPAL 1
...
GRANT SELECT,INSERT ON Table A.2 TO PRINCIPAL 2
GRANT CREATE_TABLE ON Database B TO PRINCIPAL2
...
GRANT SELECT,INSERT ON Table C.3 TO PRINCIPAL 3

7. GRANT (CREATE_TABLE ON DATABASES) ON TAGS module=Sales TO Principal 1
GRANT (SELECT, INSERT ON TABLES) ON TAGS module=Sales TO Principal 1
GRANT (CREATE_TABLE ON DATABASES) ON TAGS module=Customers TO
Principal 1
GRANT (SELECT, INSERT ON TABLES) ON TAGS module=Customers TO Principal
1
GRANT (CREATE_TABLE ON DATABASES) ON TAGS module=Orders TO Principal
2
GRANT (SELECT, INSERT ON TABLES) ON TAGS module=Orders TO Principal 2
GRANT (CREATE_TABLE ON DATABASES) ON TAGS module=Customers TO
Principal 3
GRANT (SELECT, INSERT ON TABLES) ON TAGS module=Customers TO Principal
3
Lakeformation Entitlements Simplified With Tag-Based

8. The Entitlements Problem
➢ Amazon Redshift supports resource-based entitlements b
doesn’t support tag-based entitlements.
➢ The challenge - how to map our existing tag-based
entitlementsin Lake Formation to the resource-based
entitlementsin Amazon Redshift.

9. Mapping Entitlements

10. Solution: Translate tags to Amazon Redshift grants and
revokes

11. Solution: Map all tagged resources in Lake Formation to
Amazon Redshift equivalents

12. Overall Architecture

13. Mapper Implementation

14. Business impact and value
➢Faster time to market of our data.
➢Consistency in permissions applied in both Lake Formation and Amazon
Redshift.
➢Enables more automation, users self-servicing their permissions,
auditing, dashboards and more.

15. Thank you!