Ask HN: Functional Design of a AWS Data Lake

Working on the high level 30k feet from the ground is a easy job to do, I ask my fellow members of HN.

How do you specify the functional design of a datalake under aws cloud?

Here's my background.

I'm trying to implement a function to the zones in the lake: landing, raw, trusted and refined.

To get access to the zones I came up with a user community:

- General users - Employees - Data People (scientist, analysts) - Third-party SasS - Partners

As I'm considering AWS Cognito to manage the policies around the user pool, I strugle setting the policies for each group and individual, they always endup overlapping.

How did you guys sort that out? Can you share your views, thoughts a link that I can read better into the functional details?