A customer ID is supplied to query Athena or Redshift.
Do not concatenate the value into SQL text or allow the predicate to be changed.
Which method is most appropriate?
Use a parameterized query or strict type validation so input values remain separate from SQL syntax.
Detailed explanation
The value is separated from SQL syntax and constrained to an allowed format.
The value is separated from SQL syntax and constrained to an allowed format.
Public access does not validate input and can expose sensitive data.
Public access does not validate input and can expose sensitive data.
Quotes and operators in the input can change the predicate and enable SQL injection.
Quotes and operators in the input can change the predicate and enable SQL injection.
Audit records do not make a query parameter safe.
Audit records do not make a query parameter safe.
Check official documentation
Compare the following points with the official documentation.
Amazon Athena・Redshiftのパラメータ化クエリ、IAM、S3セキュリティの公式説明を確認する。
What to confirm
SQL入力検証とS3公開・監査ログの役割を区別できる。
Key points
- Parameterized query
- Input validation
- SQL injection
- Least privilege
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Code and data separation
Binding a parameter prevents a value from becoming executable SQL syntax.
Least privilege
Limit the query role, tables, and S3 locations even after input validation.