A company stores customer address tables in an AWS Lake Formation data lake. New regulations prohibit users from accessing rows for customers who are in Canada. Which approach prevents users from seeing rows where country = Canada with the LEAST administrative effort?

Row-level filtering in AWS Lake Formation directly addresses this requirement by allowing you to define conditions (e.g., country != 'Canada') that restrict which rows users can see. This is the most straightforward and least administratively intensive method for granular row-based access control. Creating an IAM role that restricts access based on row content is not directly supported; IAM roles control access to resources, not data within those resources at a row level. Column-level filtering restricts access to entire columns, not specific rows based on a column's value. Applying tags to rows and then preventing access based on those tags is not a native Lake Formation feature for row-level security.