A retail firm stores customer data for many countries in an S3-based customer data hub used by analysts worldwide. Governance must ensure analysts can only access customer records for the same country as the analyst. Which approach enforces this with the least operational work?

Registering the S3 bucket as a data lake location in AWS Lake Formation and using its row-level security features is the most efficient solution. Lake Formation allows you to define granular access controls directly on the data catalog, enabling analysts to query a single table while only seeing rows relevant to their country. This minimizes operational overhead compared to managing separate tables or views. Creating separate tables for each country would lead to data duplication and increased management complexity. Moving data to different AWS Regions is unnecessary for access control and adds latency and cost. Loading data into Amazon Redshift and creating views for each country is a viable option but introduces an additional data store and more management than Lake Formation's native row-level filtering on S3 data.