Enable cross-Region fine-grained data access with AWS Lake Formation and Trusted Identity Propagation

This article demonstrates how to enable cross-Region fine-grained data access with AWS Lake Formation and Trusted Identity Propagation (TIP), allowing users to query data from different Regions while maintaining individual user identity and auditability.

• IAM Identity Center replicates user identities across Regions, enabling consistent access control across accounts and Regions
• Case 1: Share S3 data governed by Lake Formation, queried via Amazon Athena from a different Region using resource links
• Case 2: Share Amazon Redshift data through AWS Glue federated catalog, queried via Amazon Redshift Serverless cross-Region
• User identity propagates through the entire stack from client application to Lake Formation, enabling per-user authorization and CloudTrail auditability
• Producer and consumer accounts must be in the same organization with shared IAM Identity Center instance
• Cross-account Lake Formation grants are made in producer Region; consumers create resource links or external schemas in query Region

This architecture enables organizations to centralize data governance in one Region while allowing users in other Regions to query data with fine-grained access control and individual user auditability.