At my last job we had a lot of data in S3 queried using the data tooling like Athena or EMR.

This was useful to a lot of teams in the org but the downside was trying to lockdown certain fields like IP address to people who needed access to that data for support/operational reasons.

Amazon did come up with some IAM/grouping policy things but these were a bit clunky from what I recall. I wonder if something like this would have made it a bit more flexible to allow us to redact the IP address on the fly

EDIT: although I wonder about the performance implication of this for the "big data" use cases