Data Governance with Amazon DataZone - Data Discovery, Sharing, and Access Control
Learn how to build a domain-based data catalog and implement data discovery, sharing, and access control through subscription workflows.
DataZone Overview
DataZone is a service that unifies data discovery, sharing, and governance within an organization. Data producers publish data assets to the catalog, and data consumers search the catalog for needed data and submit subscription requests. After approval, consumers can access data directly from Athena or Redshift. DataZone provides a portal UI that allows even non-technical business users to search and browse data assets from a browser. Its primary purpose is to visualize the full landscape of an organization's data assets and enable cross-functional utilization of siloed data.
Domains and Subscriptions
Domains are logical groups corresponding to business units or teams, clarifying data ownership and management responsibility. Each domain can have a designated data owner who is delegated authority for asset publication and subscription approval within that domain. Projects are the working unit within a domain where users consume data, managing connections to analytics environments (Athena/Redshift). In the subscription workflow, consumers request access to data assets, and producers or administrators approve the requests. After approval, Lake Formation permissions are automatically granted, and consumers can execute queries from Athena.
Data Quality and Catalog Management
DataZone's data quality rules automatically validate the quality of published data assets. Define rules for completeness (percentage of NULL values), uniqueness (duplicate records), and freshness (last update date), and display quality scores in the catalog. The business glossary manages organization-wide term definitions, and by tagging data assets, you can search for data by business meaning rather than just technical table names. Metadata forms define custom attributes such as data owner, update frequency, and sensitivity level, attaching governance-relevant information to data assets. Integration with the Glue Data Catalog lets you bring existing table definitions into the DataZone catalog. Redshift tables can also be registered in the catalog. In search, users can find target assets with business glossary terms without knowing exact table names.
DataZone Pricing
DataZone pricing depends on usage. In large organizations, regularly take inventory of unnecessary assets. Leveraging existing metadata through Glue Data Catalog integration avoids duplicate catalog management.
Integration with Lake Formation and Glue - Design Patterns
DataZone integrates with Lake Formation. Permission grants during subscription approval are implemented via Lake Formation's table and column-level access controls. This enables column-level security where different consumers see different columns while referencing the same data on S3. Table definitions in the Glue Data Catalog can be brought into the DataZone catalog. For multi-account configurations, you can use a Hub-Spoke pattern where the DataZone domain is placed in a central governance account and Glue catalogs from workload accounts are federated. This configuration centralizes governance policy management while keeping data physically distributed across accounts. Environment settings link Athena workgroups or Redshift clusters, auto-provisioning a query-ready state for consumers immediately after approval.
Deployment Pitfalls and Operational Best Practices
There are common failure patterns when deploying DataZone. If domain design is too coarse (e.g., a single domain for the entire company), approval flows become centralized bottlenecks; if too granular (e.g., a domain per table), management becomes burdensome. Scope domains to business units or product lines. Starting operations without preparing a business glossary results in poor catalog search accuracy, preventing users from finding target data. Before DataZone deployment, prepare term definitions for major data domains. Setting data quality rules too strictly from the start prevents existing tables with low quality scores from being published, blocking practical adoption. Start with relaxed thresholds and improve quality in parallel. To prevent catalog staleness, assign quarterly inventory responsibility to data owners with operational rules to unpublish unused assets.
Summary
DataZone is a service that unifies data discovery, sharing, and governance. Domain-based ownership management clarifies data responsibility, and subscription workflows enable approval-based data sharing. Integration with Lake Formation provides column-level security and multi-account support for enterprise-scale governance requirements. Data quality rules and business glossaries improve catalog reliability and searchability.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- Amazon DataZone official page
- AWS Glue official page
- Amazon Athena official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.