If I understand things correctly, the modern way to to read-time masking in the AWS ecosystem is to introduce AWS Lake Formation ( https://aws.amazon.com/lake-formation/ ) as the abstraction layer between Athena and S3.