{"id":568323,"date":"2025-04-02T08:24:00","date_gmt":"2025-04-02T06:24:00","guid":{"rendered":"https:\/\/www.devoteam.com\/expert-view\/sharing-data-across-aws-account-with-amazon-datazone\/"},"modified":"2025-04-02T08:24:00","modified_gmt":"2025-04-02T06:24:00","slug":"sharing-data-across-aws-account-with-amazon-datazone","status":"publish","type":"expert-view","link":"https:\/\/devoteam.info\/lu\/expert-view\/sharing-data-across-aws-account-with-amazon-datazone\/","title":{"rendered":"Sharing Data Across AWS Account with Amazon DataZone"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Amazon DataZone is a service that provides <strong>a centralized \u201cdata mesh\u201d platform<\/strong> for data discovery, access control, and governance.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Amazon DataZone can be seen as <strong>an abstraction layer for creating <a href=\"https:\/\/devoteam.info\/lu\/amazon-web-services\/\" target=\"_blank\" rel=\"noreferrer noopener\">AWS<\/a> Lake Formation<\/strong> roles and is very useful for data sharing, even cross-account, as we will see in this article.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DataZone is composed of multiple higher-level organisational elements with the following hierarchy :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Domain(s)<\/strong>: Entity defining users, access and project management.\n<ul class=\"wp-block-list\">\n<li><strong>Project(s)<\/strong>: Logical grouping of data assets and users that are related to a specific business use case.\n<ul class=\"wp-block-list\">\n<li><strong>Environment<\/strong>: Represents a specific stage in the data lifecycle, such as development, testing, or production (inside a project).<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The service also administers blueprints. They define a set of tools for data producers for data discovery, access, lineage and metadata. There are multiple available blueprints on Amazon DataZone:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Data lake blueprint (AWS Glue, AWS Lake Formation, Amazon Athena)<\/li>\n\n\n\n<li>Data warehouse blueprint (Amazon Redshift)<\/li>\n\n\n\n<li>Amazon SageMaker blueprint (Amazon SageMaker Studio)<\/li>\n\n\n\n<li>Custom blueprints<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In this article we will explore asset sharing across two AWS accounts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This article will describe a simple setup and onboarding of DataZone.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this article, we will use the <strong>Data lake blueprint<\/strong> which supports an Athena environment and AWS Glue and Lake Formation support.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><em>Disclaimer:<\/em> <\/strong><em>Amazon DataZone<\/em> is moving to <em>Sagemaker Unified Studio<\/em> (https:\/\/aws.amazon.com\/sagemaker\/unified-studio\/), notably under the service <em>Sagemaker Catalog<\/em>. Nevertheless, we can still use DataZone by the date of this article without initializing Sagemaker Unified Studio. All features presented in this article should still be available once the service fully moves.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-schema-of-the-architecture-used\">Schema of the architecture used<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"374\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-17-1024x374.png\" alt=\"Amazon DataZone\" class=\"wp-image-562797\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-17-1024x374.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-17-300x110.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-17-768x280.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-17.png 1205w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">For reference, this is the architecture schema of our final result.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As you can see we have two AWS accounts and two projects: \u201cAdmin project\u201d and \u201cDemo Sharing Project\u201d. We will initialise DataZone in Account A, and then share our data with Account B. The Admin Project is created by default by DataZone in the account where we initialize the DataZone domain.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After the initial setup, we will create the \u201cDemo Sharing\u201d project on Account A.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The same environment will be deployed to two different AWS accounts. Using the admin default project, we will publish our first data Asset table to this demo project.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The created project will subscribe to that published Asset.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But first, let\u2019s create our DataZone domain.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Disclaimer: <\/strong>Both AWS accounts we used in this POC are in the same AWS Region.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It is important to keep in mind that we are exploring cross-account sharing here, but not cross-region sharing!<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-domain-setup-and-account-association\">Domain Setup and account association<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s start by going to the Datazone service under Amazon Sagemaker. Click on \u201cCreate an Amazon DataZone domain\u201d.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For simplicity&#8217;s sake, tick the quick setup box and keep the default suggested values for domain creation.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now, to start managing data cross-account we need to associate two AWS accounts together. To request account association, we copy the target account id (of account B), then we go under \u201cAssociate account\u201d section in our DataZone domain: <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"458\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-1-1024x458.png\" alt=\"Amazon DataZone\" class=\"wp-image-562557\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-1-1024x458.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-1-300x134.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-1-768x343.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-1-1536x686.png 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-1.png 1918w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">We select the \u201c<em>AWS Organizations RAM share<\/em>\u201d option, and then paste the target account id under it. Also, don\u2019t forget to tick the \u201c<em>AWSRAMPermissionDatazonePortalReadWrite<\/em>\u201d policy under \u201c<em>RAM Policy<\/em>\u201d, so that the target account has access to the DataZone project and its environments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On the other account, when we go to DataZone, we should find the association request we created. Now click on the review button in the appearing form. Keep all default parameters and accept them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We also need to enable blueprints used by the parent account in the target account.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We will add the Default Data Lake blueprint to the target account, which is the only blueprint we need for our use case.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"323\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-8-1024x323.png\" alt=\"\" class=\"wp-image-562662\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-8-1024x323.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-8-300x95.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-8-768x242.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-8-1536x485.png 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-8.png 1682w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Domain association should look like this after we finished the configuration :<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"514\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-25-1024x514.png\" alt=\"Amazon DataZone\" class=\"wp-image-562917\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-25-1024x514.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-25-300x151.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-25-768x386.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-25-1536x771.png 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-25.png 1918w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-demo-sharing-project-creation-nbsp\">Demo-sharing project creation&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">As mentioned before, we can find a default project called \u201cadmin\u201d in Account A after DataZone domain creation. We will use this project later to share our data asset with the demo project.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s now see how to create a project inside the Amazon DataZone portal using the demo-sharing project as an example.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We will create the project and its environment directly inside the DataZone Data portal.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can find and access the Data portal URL in the domain overview :&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/lh7-qw.googleusercontent.com\/docsz\/AD_4nXcKdWutSnuXUohLM5mp2phIXff5OYrOhgNacH_CRyMSb5r9lL-bqnFs40DU1aQtl31roygacOlRl6XnXUrW2Ec62Eastoqr4Id8xL5dTQD6M0nn72x5chdWCUJcd_rRhgCVzndi8w?key=QbEZQ0vjin2bd_79FbubyT9w\" alt=\"\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Open the portal, select the project slider on the top left and click the \u201cCreate Project\u201d Button. You will see this form:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"721\" height=\"573\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-23.png\" alt=\"\" class=\"wp-image-562887\" style=\"width:439px;height:auto\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-23.png 721w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-23-300x238.png 300w\" sizes=\"auto, (max-width: 721px) 100vw, 721px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">We will keep the project on the default domain unit and name it as displayed above.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We then need to create Datalake environments which will be available on our both AWS accounts (Account A and Account B).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Environment profiles define each environment account, permissions and settings.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These profiles would be used as a base config when creating an environment.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We will create two environment profiles and then reference the different accounts we have.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"462\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-5-1024x462.png\" alt=\"\" class=\"wp-image-562617\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-5-1024x462.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-5-300x135.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-5-768x346.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-5-1536x692.png 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-5.png 1912w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"460\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-16-1024x460.png\" alt=\"\" class=\"wp-image-562782\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-16-1024x460.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-16-300x135.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-16-768x345.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-16-1536x691.png 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-16.png 1917w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Notice that on environment profile creation, we have to add the account id as well as the target blueprint we want to use for the environment that will be created, and we need to select publishing settings.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On the target account, you need to have those blueprints enabled before.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Once we have our environment profile,s we can use them to create the environments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An environment will be a collection of tools and services provisioned in the target account as data producers tools that will be governed by DataZone using AWS Lake Formation and RAM under the hood.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Most of these tools will be provisioned by a Cloudformation stack.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Once the environment is created, we should have the following interface when we click on it.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"462\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-15-1024x462.png\" alt=\"\" class=\"wp-image-562767\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-15-1024x462.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-15-300x135.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-15-768x347.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-15-1536x693.png 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-15.png 1916w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">We should also repeat the same steps with the second environment (second environment profile for Account B).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-admin-project\">Admin project<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Each time a domain is created, we should see a default project called \u201cAdmin\u201d inside its portal.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"465\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-4-1024x465.png\" alt=\"\" class=\"wp-image-562602\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-4-1024x465.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-4-300x136.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-4-768x349.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-4-1536x698.png 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-4.png 1908w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In this project, we will create an environment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When created on your account A, this environment will provision multiple AWS resources and configurations. Each environment will have (by default) an independent Athena environment as well as two Glue databases:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Pub database: Environment database that will contain published tables to other environments.<\/li>\n\n\n\n<li>Sub database: Environment database that will have the subscribed tables from other environments.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">On the admin pub database we are going to create a glue table that will reference our sample data with a glue schema.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This data is contained within an S3 bucket on Account A, inside which we uploaded a sample csv file.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;To generate the glue schema, we crawl the bucket with a glue crawler.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This allows us to then use this glue table schema to access the data and do Athena requests inside both account A and account B. Let\u2019s see how we can make that happen thanks to DataZone.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">First, we will start by publishing the glue database (containing our glue table).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-data-sample-setup-and-publishing\">Data sample setup and publishing<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To manage data inside DataZone, we will use the pub and sub-databases created in our environment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If we create a table inside an environment&#8217;s pub database, DataZone can manage it in terms of access, metadata, and lineage\u2026 which is really useful.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;You can check the data source settings under your environment, to find the database or databases which act as a source of data for the environment. We can see the pub database name in the \u201cData Selection\u201d section.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On that database, we can create our glue tables that we want to be managed by DataZone.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"460\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-24-1024x460.png\" alt=\"\" class=\"wp-image-562902\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-24-1024x460.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-24-300x135.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-24-768x345.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-24-1536x690.png 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-24.png 1917w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Once done, don\u2019t forget to run the data source. As of now, there are only two ways to have data sources running: scheduled once per day or on demand.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When the data source finishes its run it will have scanned the DB in Data Selection and fetched up new tables created. Below you can see an example of Asset Inventory of one discovered table.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"465\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-19-1024x465.png\" alt=\"\" class=\"wp-image-562827\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-19-1024x465.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-19-300x136.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-19-768x349.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-19-1536x697.png 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-19.png 1912w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">As you can see we have a button to publish the table, which makes it discoverable by other projects and subscribable also.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Since we want to do that with other projects, we are going to publish this table.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Once done, we will receive a notification alerting us that the asset has been correctly published.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"459\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-18-1024x459.png\" alt=\"\" class=\"wp-image-562812\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-18-1024x459.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-18-300x135.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-18-768x344.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-18-1536x689.png 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-18.png 1918w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-asset-subscription\">Asset subscription<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This section will describe how we subscribe inside the demo project to a data asset located inside the admin project (to get access to our csv file data).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We can start by switching to the demo project, where we will search (using the portal search bar) the asset we want to subscribe to :<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"463\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-6-1024x463.png\" alt=\"\" class=\"wp-image-562632\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-6-1024x463.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-6-300x136.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-6-768x347.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-6-1536x694.png 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-6.png 1915w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Once the data asset is selected, we can see that a subscription button will be available on the right-hand side of the screenshot below.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"465\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-19-1024x465.png\" alt=\"\" class=\"wp-image-562827\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-19-1024x465.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-19-300x136.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-19-768x349.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-19-1536x697.png 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-19.png 1912w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Click on the button and make sure to fill out the form the DataZone portal will suggest. Make sure you have the correct asset name as well as the correct target project name.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"463\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-3-1024x463.png\" alt=\"\" class=\"wp-image-562587\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-3-1024x463.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-3-300x136.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-3-768x347.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-3-1536x695.png 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-3.png 1917w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Creating the subscription request will eventually create a notification of a share request on the portal for the source project to review.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In order to validate it, we should switch to the admin project, go to notifications, and see a subscription review. When we click on it, we should see the following form:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We can define full access here or RLS\/CLS access using create filters on rows and columns (filters operate the same way as in Lake Formation).<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"461\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-2-1024x461.png\" alt=\"\" class=\"wp-image-562572\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-2-1024x461.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-2-300x135.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-2-768x345.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-2-1536x691.png 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-2.png 1912w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Once approved, the subscription request and the asset will be added as \u201csubscribed\u201d in the target project. DataZone will add the asset inside both environments of the demo project, which belong to different AWS accounts (cf. architecture schema).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It will also handle all permissions and access settings internally.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"464\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-21-1024x464.png\" alt=\"\" class=\"wp-image-562857\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-21-1024x464.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-21-300x136.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-21-768x348.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-21-1536x696.png 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-21.png 1912w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">This screenshot shows how the asset is added to both environments. Since we are using the Datalake blueprint, we should have a proper Athena environment and workgroup that were <strong>automatically created per environment<\/strong>, which will allow us to access our data.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-asset-access\">Asset access<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This section describes data access considering Account A as a central portal which can have access on account A and account B Athena environments.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We start by searching for the asset we want to access, and then we click on the name of our asset. You will see the following page :<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"464\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-11-1024x464.png\" alt=\"\" class=\"wp-image-562707\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-11-1024x464.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-11-300x136.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-11-768x348.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-11-1536x696.png 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-11.png 1913w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">As you can see, it displays details about the asset and on the \u201cMy Subscription\u201d tab, we can see that it is added to both environments of \u201cdemo_sharing_project\u201d.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When going to a demo project\u2019s environment, we can see that on each environment, we have \u201cAnalytics tools\u201d on the right-hand side. These are links we can click to query data in an Athena environment managed by DataZone.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"462\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-15-1024x462.png\" alt=\"\" class=\"wp-image-562767\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-15-1024x462.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-15-300x135.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-15-768x347.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-15-1536x693.png 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-15.png 1916w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;When we click on \u201cQuery data\u201d, it should take us directly to Athena.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is a central access method. From the portal, we can check every project environment whether it&#8217;s in the same account or not.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Once on the Athena service, notice that since it&#8217;s an environment managed by DataZone we don&#8217;t see any workgroup switcher, but we have a datazone environment chosen for us, as well as an IAM role which we are assuming. This role and environment were created during the creation of the DataZone project environment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As you can see below, we are able to query our bucket data inside Athena :<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"458\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-10-1024x458.png\" alt=\"\" class=\"wp-image-562692\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-10-1024x458.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-10-300x134.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-10-768x344.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-10-1536x687.png 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-10.png 1917w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">We can access data assets on separate accounts without going through the Amazon DataZone portal by using the \u201cdatazone_usr_*\u201d IAM role provided at the environment creation.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Each datazone environment will provision an access role that will be called&nbsp; \u201cdatazone_usr_*\u201d.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To use it, we should start by switching role on the datazone_usr_* role as follows :<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"517\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-14-1024x517.jpg\" alt=\"Amazon DataZone\" class=\"wp-image-562752\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-14-1024x517.jpg 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-14-300x151.jpg 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-14-768x387.jpg 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-14-1536x775.jpg 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-14.jpg 1576w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">After the role switch, if we go under Athena we should have access to the workgroup managed by Amazon DataZone. We also can query the same data from Account B, as you can see here, and we see that DataZone selected by default the correct workgroup when we opened Athena from inside the DataZone portal from account B :<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"515\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-22-1024x515.png\" alt=\"Amazon DataZone\" class=\"wp-image-562872\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-22-1024x515.png 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-22-300x151.png 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-22-768x386.png 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-22-1536x772.png 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-22.png 1916w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-cleanup\">Cleanup<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When finished, it\u2019s important to clean up your resources.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Start by unsubscribing from assets on the demo sharing project, unpublish and delete the asset on the admin project. Then, delete the demo project and its environment (start by deleting environments first).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Afterwards, you can delete the glue databases (pub &amp; sub). Also delete the S3 bucket we used along with workgroup Athena and cloudwatch Log Groups.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-pro-amp-cons\">Pro &amp; Cons<\/h2>\n\n\n\n<h3 class=\"wp-block-heading has-medium-font-size\" id=\"h-pros-of-using-datazone\"><strong>Pros of using DataZone:<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Centralised data sharing tool:<\/strong> DataZone provides a centralised platform for data discovery, making it easy for users to access and share the data across different AWS accounts.<\/li>\n\n\n\n<li><strong>Enforced data access control:<\/strong> DataZone helps to enforce data access control by allowing organisations to define and manage access policies for their users (domain unit or project management), projects (asset management), and data assets (Rows and columns RLS\/CLS).<\/li>\n\n\n\n<li><strong>Support for multiple data sources:<\/strong> DataZone supports a variety of data sources, making it easy for organisations to share data from different sources (including Amazon EMR, Aurora and Redshift).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading has-medium-font-size\" id=\"h-cons-of-using-amazon-datazone\">Cons of using Amazon DataZone :<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>DataZone is still a relatively new service, and there may be some kinks to work out (the documentation is also not always reliable yet).<\/li>\n\n\n\n<li>DataZone can be complex to set up and configure, especially for large organisations with complex data-sharing needs.<\/li>\n\n\n\n<li>DataZone may not be necessary for all use cases. If you have a small number of S3 buckets and a simple data-sharing need, you may be able to get by without using DataZone, as it can be more expensive and cumbersome.<\/li>\n\n\n\n<li>DataZone is not yet compatible with all data sources or data formats (for example, view subscription is not supported for now)<\/li>\n\n\n\n<li>The service badly scales up under heavy loads (errored operations after a few hundred parallel actions)<\/li>\n\n\n\n<li>Very verbose API, inconsistent response time, infrequent timeouts.&nbsp;<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-conclusion\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Amazon DataZone is a relatively new service, with new features being added regularly (such as the lineage feature announced recently). It is very interesting, especially from a Data Engineer perspective.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We can view it as an abstraction layer of Lake Formation. It makes handling and managing Lake Formation easier, and the automatic role creation is really helpful. DataZone could be worth trying if you already use or plan to use the LakeFormation service, as it simplifies the headache of its configuration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As mentioned in the introduction, DataZone service is actually moving to Sagemaker Unified Studio to become Sagemaker Catalog. The service itself will have the same features as DataZone, plus other improvements and new features belonging to Amamzon SageMaker suite. You can compare both services using the Sagemaker catalog demo here <a href=\"https:\/\/aws.storylane.io\/share\/szmiwp3unlio\">https:\/\/aws.storylane.io\/share\/szmiwp3unlio<\/a> (make sure to choose demo catalog in Choose your journey list)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Since DataZone is a lakehouse, it is also helpful in managing access and governing data from various data sources &#8211; even across different accounts, as we saw in this article. Overall, it is a service that grows by the day and it is definitely worth keeping an eye on it!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Amazon DataZone is a service that provides a centralized \u201cdata mesh\u201d platform for data discovery, access control, and governance.&nbsp; Amazon DataZone can be seen as an abstraction layer for creating AWS Lake Formation roles and is very useful for data sharing, even cross-account, as we will see in this article. DataZone is composed of multiple [&hellip;]<\/p>\n","protected":false},"featured_media":148568,"template":"","categories":[1628,1632],"tags":[],"industry":[],"class_list":["post-568323","expert-view","type-expert-view","status-publish","has-post-thumbnail","hentry","category-aws","category-data"],"acf":[],"cards":"\n\t<div class=\"single-post-card\">\n\n\t\t<figure class=\"wp-block-post-featured-image\"><a href=\"https:\/\/devoteam.info\/lu\/expert-view\/sharing-data-across-aws-account-with-amazon-datazone\/\" target=\"_self\" ><img width=\"1920\" height=\"1080\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2024\/11\/GettyImages-2162026367.jpg\" class=\"attachment-post-thumbnail size-post-thumbnail wp-post-image\" alt=\"Sharing Data Across AWS Account with Amazon DataZone\" style=\"aspect-ratio:4\/3;width:100%;object-fit:cover;\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2024\/11\/GettyImages-2162026367.jpg 1920w, https:\/\/devoteam.info\/wp-content\/uploads\/2024\/11\/GettyImages-2162026367-300x169.jpg 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2024\/11\/GettyImages-2162026367-1024x576.jpg 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2024\/11\/GettyImages-2162026367-768x432.jpg 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2024\/11\/GettyImages-2162026367-1536x864.jpg 1536w\" sizes=\"auto, (max-width: 1920px) 100vw, 1920px\" \/><\/a><\/figure>\n\n\t\t\n\t\t<div class=\"wp-block-group is-vertical is-layout-flex wp-container-core-group-is-layout-43282307 wp-block-group-is-layout-flex\">\n\t<p style=\"font-style:normal;font-weight:700\" class=\"has-link-color wp-elements-1 wp-block-lp-post-type has-text-color has-primary-color has-small-font-size\">Expert View<\/p>\n\n\t\t\n\t\t<h3 style=\"font-style:normal;font-weight:400\" class=\"wp-block-post-title has-base-font-size\"><a href=\"https:\/\/devoteam.info\/lu\/expert-view\/sharing-data-across-aws-account-with-amazon-datazone\/\" target=\"_self\" >Sharing Data Across AWS Account with Amazon DataZone<\/a><\/h3><\/div>\n\t\t\n\t<\/div>\n\n","yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.4 (Yoast SEO v28.4) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Sharing Data Across AWS Account with Amazon DataZone | Devoteam<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/devoteam.info\/lu\/expert-view\/sharing-data-across-aws-account-with-amazon-datazone\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Sharing Data Across AWS Account with Amazon DataZone\" \/>\n<meta property=\"og:description\" content=\"Amazon DataZone is a service that provides a centralized \u201cdata mesh\u201d platform for data discovery, access control, and governance.&nbsp; Amazon DataZone can be seen as an abstraction layer for creating AWS Lake Formation roles and is very useful for data sharing, even cross-account, as we will see in this article. DataZone is composed of multiple [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/devoteam.info\/lu\/expert-view\/sharing-data-across-aws-account-with-amazon-datazone\/\" \/>\n<meta property=\"og:site_name\" content=\"Devoteam\" \/>\n<meta property=\"og:image\" content=\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-17.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1205\" \/>\n\t<meta property=\"og:image:height\" content=\"440\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"12 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/expert-view\\\/sharing-data-across-aws-account-with-amazon-datazone\\\/\",\"url\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/expert-view\\\/sharing-data-across-aws-account-with-amazon-datazone\\\/\",\"name\":\"Sharing Data Across AWS Account with Amazon DataZone | Devoteam\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/expert-view\\\/sharing-data-across-aws-account-with-amazon-datazone\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/expert-view\\\/sharing-data-across-aws-account-with-amazon-datazone\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/devoteam.info\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/GettyImages-2162026367.jpg\",\"datePublished\":\"2025-04-02T06:24:00+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/expert-view\\\/sharing-data-across-aws-account-with-amazon-datazone\\\/#breadcrumb\"},\"inLanguage\":\"en-LU\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/devoteam.info\\\/lu\\\/expert-view\\\/sharing-data-across-aws-account-with-amazon-datazone\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-LU\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/expert-view\\\/sharing-data-across-aws-account-with-amazon-datazone\\\/#primaryimage\",\"url\":\"https:\\\/\\\/devoteam.info\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/GettyImages-2162026367.jpg\",\"contentUrl\":\"https:\\\/\\\/devoteam.info\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/GettyImages-2162026367.jpg\",\"width\":1920,\"height\":1080},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/expert-view\\\/sharing-data-across-aws-account-with-amazon-datazone\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Expert View\",\"item\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/expert-view\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Sharing Data Across AWS Account with Amazon DataZone\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/#website\",\"url\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/\",\"name\":\"Devoteam\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-LU\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Sharing Data Across AWS Account with Amazon DataZone | Devoteam","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/devoteam.info\/lu\/expert-view\/sharing-data-across-aws-account-with-amazon-datazone\/","og_locale":"en_US","og_type":"article","og_title":"Sharing Data Across AWS Account with Amazon DataZone","og_description":"Amazon DataZone is a service that provides a centralized \u201cdata mesh\u201d platform for data discovery, access control, and governance.&nbsp; Amazon DataZone can be seen as an abstraction layer for creating AWS Lake Formation roles and is very useful for data sharing, even cross-account, as we will see in this article. DataZone is composed of multiple [&hellip;]","og_url":"https:\/\/devoteam.info\/lu\/expert-view\/sharing-data-across-aws-account-with-amazon-datazone\/","og_site_name":"Devoteam","og_image":[{"width":1205,"height":440,"url":"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/03\/Devoteam_Expert-view_AWS_DataZone_Sharing-Data-Across-AWS-Account-17.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"12 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/devoteam.info\/lu\/expert-view\/sharing-data-across-aws-account-with-amazon-datazone\/","url":"https:\/\/devoteam.info\/lu\/expert-view\/sharing-data-across-aws-account-with-amazon-datazone\/","name":"Sharing Data Across AWS Account with Amazon DataZone | Devoteam","isPartOf":{"@id":"https:\/\/devoteam.info\/lu\/#website"},"primaryImageOfPage":{"@id":"https:\/\/devoteam.info\/lu\/expert-view\/sharing-data-across-aws-account-with-amazon-datazone\/#primaryimage"},"image":{"@id":"https:\/\/devoteam.info\/lu\/expert-view\/sharing-data-across-aws-account-with-amazon-datazone\/#primaryimage"},"thumbnailUrl":"https:\/\/devoteam.info\/wp-content\/uploads\/2024\/11\/GettyImages-2162026367.jpg","datePublished":"2025-04-02T06:24:00+00:00","breadcrumb":{"@id":"https:\/\/devoteam.info\/lu\/expert-view\/sharing-data-across-aws-account-with-amazon-datazone\/#breadcrumb"},"inLanguage":"en-LU","potentialAction":[{"@type":"ReadAction","target":["https:\/\/devoteam.info\/lu\/expert-view\/sharing-data-across-aws-account-with-amazon-datazone\/"]}]},{"@type":"ImageObject","inLanguage":"en-LU","@id":"https:\/\/devoteam.info\/lu\/expert-view\/sharing-data-across-aws-account-with-amazon-datazone\/#primaryimage","url":"https:\/\/devoteam.info\/wp-content\/uploads\/2024\/11\/GettyImages-2162026367.jpg","contentUrl":"https:\/\/devoteam.info\/wp-content\/uploads\/2024\/11\/GettyImages-2162026367.jpg","width":1920,"height":1080},{"@type":"BreadcrumbList","@id":"https:\/\/devoteam.info\/lu\/expert-view\/sharing-data-across-aws-account-with-amazon-datazone\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/devoteam.info\/lu\/"},{"@type":"ListItem","position":2,"name":"Expert View","item":"https:\/\/devoteam.info\/lu\/expert-view\/"},{"@type":"ListItem","position":3,"name":"Sharing Data Across AWS Account with Amazon DataZone"}]},{"@type":"WebSite","@id":"https:\/\/devoteam.info\/lu\/#website","url":"https:\/\/devoteam.info\/lu\/","name":"Devoteam","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/devoteam.info\/lu\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-LU"}]}},"uagb_featured_image_src":{"full":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/11\/GettyImages-2162026367.jpg",1920,1080,false],"thumbnail":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/11\/GettyImages-2162026367-150x150.jpg",150,150,true],"medium":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/11\/GettyImages-2162026367-300x169.jpg",300,169,true],"medium_large":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/11\/GettyImages-2162026367-768x432.jpg",768,432,true],"large":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/11\/GettyImages-2162026367-1024x576.jpg",1024,576,true],"1536x1536":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/11\/GettyImages-2162026367-1536x864.jpg",1536,864,true],"2048x2048":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/11\/GettyImages-2162026367.jpg",1920,1080,false]},"uagb_author_info":{"display_name":"julien.lemarchal","author_link":"https:\/\/devoteam.info\/lu\/author\/"},"uagb_comment_info":0,"uagb_excerpt":"Amazon DataZone is a service that provides a centralized \u201cdata mesh\u201d platform for data discovery, access control, and governance.&nbsp; Amazon DataZone can be seen as an abstraction layer for creating AWS Lake Formation roles and is very useful for data sharing, even cross-account, as we will see in this article. DataZone is composed of multiple&hellip;","_links":{"self":[{"href":"https:\/\/devoteam.info\/lu\/wp-json\/wp\/v2\/expert-view\/568323","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devoteam.info\/lu\/wp-json\/wp\/v2\/expert-view"}],"about":[{"href":"https:\/\/devoteam.info\/lu\/wp-json\/wp\/v2\/types\/expert-view"}],"version-history":[{"count":0,"href":"https:\/\/devoteam.info\/lu\/wp-json\/wp\/v2\/expert-view\/568323\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devoteam.info\/lu\/wp-json\/wp\/v2\/media\/148568"}],"wp:attachment":[{"href":"https:\/\/devoteam.info\/lu\/wp-json\/wp\/v2\/media?parent=568323"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devoteam.info\/lu\/wp-json\/wp\/v2\/categories?post=568323"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devoteam.info\/lu\/wp-json\/wp\/v2\/tags?post=568323"},{"taxonomy":"industry","embeddable":true,"href":"https:\/\/devoteam.info\/lu\/wp-json\/wp\/v2\/industry?post=568323"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}