Customer data in S3 contains personal information but must be made available to an analytics team.
Combine encryption at rest with controls that prevent analysts from reading unnecessary columns.
Which two controls meet the requirement?
Encrypt with SSE-KMS and restrict key use, then limit visible columns with Lake Formation permissions or masking.
Detailed explanation
Only work-required columns are exposed while unnecessary personal information is hidden.
Only work-required columns are exposed while unnecessary personal information is hidden.
Required joins or analyses may be broken; the transformation is not purpose-driven minimization.
Required joins or analyses may be broken; the transformation is not purpose-driven minimization.
Secret exposure and loss of key governance can result.
Secret exposure and loss of key governance can result.
Audit records do not replace encryption or authorization for stored data.
Audit records do not replace encryption or authorization for stored data.
Encryption at rest and decryption authority are separated, and key use can be audited.
Encryption at rest and decryption authority are separated, and key use can be audited.
Check official documentation
Compare the following points with the official documentation.
S3 SSE-KMS、AWS KMS key policy、Lake Formation column-level permissionsの公式説明を確認する。
What to confirm
暗号化、鍵認可、列制御、監査を一つの対策と混同せず組み合わせられる。
Key points
- SSE-KMS
- Key policy
- Column-level permission
- Data masking
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Defense in depth
Protect the stored object, the decryption key, and the data view at separate layers.
Data minimization
Expose only the fields required for the documented analytical purpose.