Databricks and AWS · Comparison

Unity Catalog vs AWS Lake Formation: Which Governs Your Lakehouse

Unity Catalog is the governance layer built into Databricks: one permission model, lineage and audit for tables, files, models and functions across every workspace. AWS Lake Formation governs data in Amazon S3 and its metadata in the AWS Glue Data Catalog for AWS engines such as Amazon Athena and Amazon EMR. Which you use depends on which engines read the data.

Last updated October 2026.

What they have in common

Both replace bucket-level and file-level access with grants on catalog objects, in the style of a relational database: grant SELECT on a table, revoke it later. Both go below the table to rows and columns, both can grant by tag instead of object by object, and both keep a central audit trail. The question they answer is the same: who can see which rows and columns of one shared copy of the data.

Unity Catalog: governance inside Databricks

Scope: one metastore per region, shared by all workspaces in that region. Users, groups and service principals are defined at the Databricks account level.
Hierarchy: a three-level namespace, catalog.schema.object, for tables, views, volumes (files), functions and models. Storage credentials and external locations govern the cloud storage paths underneath.
Fine-grained access: privileges, row filters and column masks written as SQL functions, attribute-based policies, and workspace bindings that tie a catalog to specific workspaces.
Lineage and audit: lineage is captured automatically across tables, models and dashboards; an audit log system table records access.
Sharing: Delta Sharing (called OpenSharing in the 2026 docs) shares live data across organizations and clouds.

Unity Catalog is enabled automatically for Databricks workspaces created after 8 November 2023, which is why both Databricks data engineer exams treat it as the default.

AWS Lake Formation: governance for AWS analytics

Scope: data in S3 and its metadata in the AWS Glue Data Catalog, with federated catalogs reaching Amazon Redshift and other sources.
Permission model: its own grant and revoke model that augments IAM, applied to IAM users and roles and federated identities.
Fine-grained access: database, table, column, row and cell level, the last two through data filters. LF-Tags grant across many tables at once.
Enforcement: Amazon Athena, Amazon Quick, Amazon Redshift Spectrum, Amazon EMR and AWS Glue all honor Lake Formation permissions.
Audit and sharing: access is logged in AWS CloudTrail, and grants can be shared with other AWS accounts and organizations.

Hybrid access mode lets a team turn on Lake Formation permissions for some tables and users while existing IAM and S3 policies keep working for the rest, so adoption can be gradual.

Side by side

	Unity Catalog	Lake Formation
Governs	Data and AI assets in Databricks	S3 data cataloged in Glue, plus federated sources
Identities	Databricks account users, groups, service principals	IAM users and roles, federated users
Rows and columns	Row filters and column masks (SQL functions)	Data filters for rows, columns and cells
By tag	Attribute-based policies	LF-Tags
Lineage	Built in, automatic	Not a Lake Formation feature
Audit	Audit log system table	AWS CloudTrail
Engines	Databricks compute and SQL warehouses	Athena, Quick, Redshift Spectrum, EMR, Glue

From the Databricks Unity Catalog documentation and the AWS Lake Formation Developer Guide, checked 27 October 2026.

Running both

Many companies on AWS have both: Databricks for engineering and ML, Athena or Redshift for other teams. Unity Catalog can federate an existing AWS Glue Data Catalog as a foreign catalog, so Glue-registered tables are governed in Unity Catalog without moving them. Databricks documents one catch: the service credential's Lake Formation permissions must stay in place, because losing them even briefly can drop and recreate the foreign catalog's schemas and break schema-level grants.

The practical rule is one source of truth per table. Decide which catalog owns each dataset's permissions, and treat the other as a reader.

Where each shows up on the exams

Unity Catalog

Databricks Data Engineer Associate (hierarchy, grants, row filters and column masks) and Professional (least privilege, masking, Delta Sharing). Signals: "across workspaces", "three-part name", "lineage".

Lake Formation

AWS Solutions Architect Associate (securing a data lake) and Data Engineer Associate (IAM vs Lake Formation, sharing). Signals: "Athena users see some columns", "one copy of the data", "LF-Tags".

The tempting wrong answer on AWS exams: an S3 bucket policy to hide columns. Bucket policies work on whole objects, so they cannot hide a column inside a Parquet file. Column-level access is Lake Formation's job.

FAQ

What is the difference between Unity Catalog and Lake Formation?

Unity Catalog governs data and AI assets inside Databricks across all workspaces, with built-in lineage. Lake Formation governs S3 data cataloged in the AWS Glue Data Catalog for AWS engines such as Athena, EMR and Redshift Spectrum. Both grant access down to rows and columns.

Can Unity Catalog read the AWS Glue Data Catalog?

Yes. Unity Catalog can federate an AWS Glue Data Catalog as a foreign catalog, so Glue tables are governed in Databricks without moving them. The service credential's Lake Formation permissions must remain in place for this to keep working.

Does Lake Formation replace IAM?

No. Lake Formation adds its own permission model on top of IAM for Data Catalog objects and the S3 data behind them. Hybrid access mode lets both work side by side while a team moves tables to Lake Formation gradually.

Do I need Unity Catalog for the Databricks Data Engineer Associate exam?

Yes. Unity Catalog is the default governance layer in the current exam guide, so expect questions on the catalog.schema.table hierarchy, GRANT and REVOKE, and row filters and column masks.

Start with the hierarchy

Chapter 3 of the Certified Databricks Data Engineer Associate course introduces Unity Catalog and is free. Lake Formation is taught in Chapter 56 of the SAA-C03 course and Chapter 32 of the DEA-C01 course.

Open Chapter 3 →