What's changed: In-scope coverage: added network boundary/defense (VPC/PrivateLink/WAF/Shield)
4.1Data Encryption and Access Control
Understand encryption at rest/in transit (KMS/TLS), least-privilege access control with IAM and bucket policies, and detecting/classifying/masking sensitive data with Macie. The starting point for "Data Security and Governance" in DEA-C01.
A data platform must have encryption, access control, and protection of sensitive data. On AWS, KMS, IAM, and Macie play central roles.
4.1.1Encryption, access, and classification
- Encryption: at rest with KMS (S3/EBS/RDS), in transit with TLS; keys centrally managed and audited.
- Access control: control "who can access what" with IAM least privilege and bucket policies; use roles, not keys.
- Detect & classify: Amazon Macie finds/classifies PII in S3; mask/tokenize as needed.
Common on DEA: encryption at rest = KMS, find/classify sensitive data (PII) = Macie, least-privilege access = IAM/bucket policy, protect sensitive columns = masking/tokenization.
Data protection layers "encryption, access control, and sensitive-data classification." Encryption at rest uses KMS (S3 with SSE-S3/SSE-KMS; enable on EBS/RDS/Redshift too), controlling who can decrypt with which key via key policy + IAM, audited by CloudTrail. In transit enforces TLS (S3 bucket policy requiring aws:SecureTransport). Access control uses IAM least privilege plus resource-based (bucket) policies, with roles (temporary credentials) instead of long-lived keys. Lake-wide permissions are centralized via Lake Formation (next section). For sensitive data, Amazon Macie uses ML to find/classify PII in S3, and you protect it with masking/tokenization (Glue transforms, Redshift dynamic data masking, column encryption). Use AWS managed keys / customer managed keys (CMK) per requirement, and Secrets Manager for secrets—never plaintext in code or env vars.
| Protect | Means |
|---|---|
| Data at rest | KMS (SSE-KMS, etc.) |
| Traffic in transit | TLS (enforce SecureTransport) |
| Access permissions | IAM least privilege + roles |
| Sensitive data (PII) | Detect with Macie → mask/tokenize |
Scenario: check the data lake for stray PII and protect it. Scan S3 with Macie to find/classify PII. Mask/tokenize those columns with Glue before the curated layer. Store with SSE-KMS, enforce TLS in transit, and use IAM least privilege + roles for access. Audit key usage and who accessed what with CloudTrail.
Q. Keys for encryption at rest? KMS. Q. Find/classify PII? Macie. Q. Protect sensitive columns? Masking/tokenization. Q. Access best practice? IAM least privilege + roles (no embedded keys). Q. Enforce encrypted transit? Require SecureTransport in the bucket policy.
Watch the mix-ups: (1) Macie finds/classifies sensitive data—distinct from encryption (KMS) or access control (IAM). (2) Enabling encryption at rest still needs separate access control (encryption ≠ authorization). (3) Never embed long-lived access keys—use roles. (4) Cover both in-transit and at-rest encryption (one alone is insufficient).
Best practice: enable encryption in transit/at rest across pipeline components (Glue jobs, Redshift, etc.) and run with least-privilege roles.
4.1.2In-scope services for network boundary and defense
The network boundary of a data pipeline is also in scope. Place all resources inside an Amazon VPC, isolated by subnets/routing/security groups, and connect to external data stores or services in other accounts privately via AWS PrivateLink (interface endpoints) without traversing the internet (VPC-endpoint access to S3/KMS is a standard way to narrow exfiltration paths). For public analytics APIs or endpoints (in front of API Gateway/ALB), filter L7 web attacks (SQLi/XSS) with rules via AWS WAF and protect against DDoS with AWS Shield (Shield Advanced adds enhanced mitigation and response support). Combine these with encryption (KMS/TLS) and least privilege (IAM) for defense in depth.
4.1.3Section summary
- Encryption (KMS/TLS) / least privilege (IAM) / classification (Macie)
- Mask/tokenize sensitive fields
- Network boundary = VPC/PrivateLink; public defense = WAF (web attacks) / Shield (DDoS)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to use ML to discover and classify PII stored in S3. Which fits best?
Q2. Which service centrally manages keys for encryption at rest of S3/Redshift?
Q3. Which is the best practice for controlling access to data?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.