Production customer data must be provided to analysts.
Email and phone values are not needed, and analysts must not receive the source-table permissions.
Which protection approach is most appropriate?
Create a masked analytical table through ETL and separate its permissions from the source table.
Detailed explanation
Another query or export path can expose the source values.
Another query or export path can expose the source values.
Analysts receive only the transformed values needed for their work.
Analysts receive only the transformed values needed for their work.
Deletion can violate business, audit, and recovery requirements.
Deletion can violate business, audit, and recovery requirements.
An audit principal is not an anonymization method.
An audit principal is not an anonymization method.
Check official documentation
Compare the following points with the official documentation.
AWS data masking、Macie sensitive data discovery、Glue ETLの公式説明を確認する。
What to confirm
UI列非表示・削除と、分析用マスキングテーブルの違いを説明できる。
Key points
- Masking
- PII
- Analytical table
- Source separation
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Reversibility
Use tokenization or encryption only when controlled re-identification is required.
Leakage surface
Protect logs, temporary files, backups, and error messages as well as tables.