The reason resources are shared between customer accounts and the service accounts is because AWS Healthlake is a fully managed service. The service account does not have access to the data in your account and is only orchestrating the resources behind AWS Healthlake including Glue, Lambda, and Lake Formation among others. AWS Healthlake uses Lake formation in conjunction with Glue and Resource Access Manager (RAM) to provide a managed experience where the customer’s Glue catalog is shared with the customer’s account. However, the Glue catalog is a logical view, and not where the data resides.
This enables AWS HealthLake to transform your HealthLake datastore FHIR data into a format that can be queried using Athena. AWS HealthLake creates tables as FHIR resource types in AWS HealthLake owned service accounts and shares them with customer accounts using LakeFormation named resource share method. The “another account” is essentially the AWS HealthLake service account where customer data is encrypted at rest within AWS HealthLake service boundary to ensure security and HIPAA-eligible requirements are met.