What's changed: In-scope coverage: added network boundary/defense (VPC/PrivateLink/WAF/Shield)
4.1Data Encryption and Access Control
Understand encryption at rest/in transit (KMS/TLS), least-privilege access control with IAM and bucket policies, and detecting/classifying/masking sensitive data with Macie. The starting point for "Data Security and Governance" in DEA-C01.
A data platform must have encryption, access control, and protection of sensitive data. On AWS, KMS, IAM, and Macie play central roles.
4.1.1Encryption, access, and classification
- Encryption: at rest with KMS (S3/EBS/RDS), in transit with TLS; keys centrally managed and audited.
- Access control: control "who can access what" with IAM least privilege and bucket policies; use roles, not keys.
- Detect & classify: Amazon Macie finds/classifies PII in S3; mask/tokenize as needed.
Common on DEA: encryption at rest = KMS, find/classify sensitive data (PII) = Macie, least-privilege access = IAM/bucket policy, protect sensitive columns = masking/tokenization.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.