4Data Security and Governance

• 4.1Data Encryption and Access Control

  Understand encryption at rest/in transit (KMS/TLS), least-privilege access control with IAM and bucket policies, and detecting/classifying/masking sensitive data with Macie. The starting point for "Data Security and Governance" in DEA-C01.

• 4.2Governance and Compliance (Lake Formation)

  Understand data governance: fine-grained (column/row-level) access management with AWS Lake Formation, auditing with CloudTrail, and classification/data lineage with tags.