Customer data in S3 will be transformed into a development dataset.
Users must not be able to recover email addresses or phone numbers, while non-sensitive columns remain useful.
Which processing design is most appropriate?
Mask, tokenize, or irreversibly hash sensitive columns in Glue ETL and separate output permissions.
Detailed explanation
Broad access violates least privilege and increases exposure.
Broad access violates least privilege and increases exposure.
Renaming a bucket does not change the confidentiality of object contents.
Renaming a bucket does not change the confidentiality of object contents.
Transforming values before delivery reduces exposure while permissions protect the resulting dataset.
Transforming values before delivery reduces exposure while permissions protect the resulting dataset.
Removing monitoring data does not mask columns in the dataset.
Removing monitoring data does not mask columns in the dataset.
Check official documentation
Compare the following points with the official documentation.
AWS Glueの変換、Amazon Macieの機密情報検出、KMS・IAMの公式説明を確認する。
What to confirm
値の変換とアクセス制御を組み合わせたデータ最小化を説明できる。
Key points
- Masking
- Hashing
- Sensitive column
- Data minimization
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Re-identification
A protection method must be chosen based on whether a controlled recovery path is required.
Defense in depth
Transformation, KMS, IAM, bucket policy, and audit logs provide complementary controls.