Amazon DEA-C01: Data Security, Governance, and Compliance — Study Guide

By Laurynas Brazys · 2 August 2026 · #amazon #dea-c01 #certification #exam-prep #study-guide

Part of the Amazon Data Engineer Associate DEA-C01 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.

This domain covers the controls, services, and operational patterns that keep data protected, auditable, and compliant while enabling analytics. Data engineers must design encryption, access control, discovery, and masking so analytics workflows run without exposing PII or breaking service integrations. The section below focuses on concrete AWS services and configurations—S3/Redshift encryption, KMS, IAM and resource policies, Lake Formation fine-grained access, Macie discovery, and network controls such as VPC endpoints—plus decision criteria you’ll use when designing pipelines.

Encryption at rest and in transit for data services

Encrypt data in transit using TLS for all AWS service endpoints and client SDKs; enforce with service endpoints, ALBs, API Gateway, and by requiring HTTPS on S3 bucket policies. For at-rest encryption in S3 choose among SSE-S3, SSE-KMS, SSE-C, or client-side encryption with the following trade-offs and CLI/console patterns:

SSE-S3 (AES-256 managed by AWS): simplest; enable default on a bucket with aws s3api put-bucket-encryption –bucket my-bucket –server-side-encryption-configuration ‘{“Rules”:[{“ApplyServerSideEncryptionByDefault”:{“SSEAlgorithm”:“AES256”}}]}’.
SSE-KMS (AWS KMS keys): supports key rotation, IAM and KMS key policies, and audit via CloudTrail; set bucket default with SSE-KMS and specify –sse-kms-key-id. Requires granting services and principals both IAM permissions and KMS key policy access (see KMS key policy note below).
SSE-C (customer-provided keys): customer supplies key on each request; no KMS usage; operational complexity for key transfer and key compromise handling.
Client-side encryption: encrypt before upload using the AWS Encryption SDK or client libraries for envelope encryption; keys are managed by client or custom KMS usage. Use when you must retain full control of plaintext key material.

Decision criteria:

Use SSE-S3 for low operational overhead and no customer-managed keys.
Use SSE-KMS for auditability, key rotation, and when sharing encrypted snapshots across accounts or services.
Use SSE-C or client-side encryption when you must ensure AWS never has access to plaintext or key material.

Redshift encryption: enable encryption at cluster creation by specifying –encrypted and –kms-key-id or via console. Encryption cannot be enabled in-place on an unencrypted cluster; to encrypt an existing cluster snapshot and restore to an encrypted cluster, use aws redshift create-cluster or the RestoreFromClusterSnapshot workflow with –kms-key-id. KMS key policy must explicitly allow Redshift to use the key (kms:Encrypt, kms:Decrypt, kms:GenerateDataKey).

For all KMS-backed services, ensure TLS in transit and limit plaintext exposure in logs and snapshots.

IAM policies and resource-based policies for data access

IAM identity policies and resource-based policies (S3 bucket policies, KMS key policies, VPC endpoint policies) together determine access. A specific approach:

Use IAM roles for compute/service principals (EMR, Glue, Redshift, Lambda) and attach least-privilege policies allowing necessary S3, Glue, Redshift, and KMS actions.
Use resource-based policies to restrict which principals or VPC endpoints can access S3 buckets or APIs; apply explicit Deny statements carefully because Deny overrides Allow.
For VPC-restricted access, create a gateway VPC endpoint for S3 and interface endpoints for Glue, KMS, Secrets Manager, and control access with endpoint policies.

CLI/console patterns:

Create gateway endpoint: aws ec2 create-vpc-endpoint –vpc-id vpc-123 –service-name com.amazonaws.us-east-1.s3 –route-table-ids rtb-123
Create interface endpoint for Glue: aws ec2 create-vpc-endpoint –vpc-id vpc-123 –service-name com.amazonaws.us-east-1.glue –subnet-ids subnet-1 subnet-2 –security-group-ids sg-1

Decision criteria:

Use resource policies to enforce cross-account constraints or to require traffic originate from specific VPC endpoints.
Use IAM for identity-centric permissions and KMS key policies to authorize services to use keys — IAM alone is insufficient to allow KMS usage.

Lake Formation fine-grained permissions

Lake Formation centralizes data lake access control on top of the Glue Data Catalog and provides column-level and row-level security for Athena and Glue jobs. Key patterns:

Register S3 locations as data lake locations in Lake Formation and grant DATA_LOCATION_ACCESS to the role that reads/writes those locations.
Grant table-level and column-level permissions via Lake Formation console or aws lakeformation grant-permissions; column-level grants use a column list parameter and affect Athena and Glue queries that use the Data Catalog.
For row-level security, define LF-tags or row filters on tables and attach policies that apply predicates to data returned by Athena. Row-level filters are evaluated by the Lake Formation service during query planning.

Operational details:

Both Lake Formation permissions and IAM permissions are evaluated; the most restrictive result applies. Ensure jobs have both IAM role S3 access and Lake Formation grants.
When using Athena, set the workgroup to use the Glue Data Catalog and configure the query results S3 location with proper LF access.

Decision criteria:

Use Lake Formation column-level controls when you need to hide sensitive columns from downstream analysts.
Use row-level policies for multi-tenant datasets where row predicates must restrict visibility by principal.
Continue to use IAM and S3 bucket policies for coarse-grained enforcement (bucket/object level) and Lake Formation for catalog-driven fine-grained enforcement.

Data masking, tokenization, and PII handling

Detect PII using Amazon Macie to scan S3 buckets and run classification jobs with managed data identifiers. Macie provides automated discovery and alerting for PII, and findings can be routed to Security Hub or CloudWatch Events for downstream workflows. Configure Macie jobs via console or aws macie2 create-classification-job, select S3 bucket scope, and choose managed identifiers.

For masking and tokenization:

Use AWS Glue transformations (Glue ETL PySpark) or AWS Lambda to apply deterministic or format-preserving masking/tokenization during ingestion. Consider AWS Glue Studio job bookmarks and job parameters for consistent processing.
For tokenization where tokens must be reversible, use a KMS-backed HSM or third-party tokenization service; store token maps in a secured DynamoDB table encrypted with KMS and restrict access to authorized services.
For irreversible masking, apply one-way hashing (salted) with secure salts from Secrets Manager and rotate salts carefully to avoid breaking joins.

Networking and private traffic:

Use S3 gateway endpoints and interface endpoints for Glue and Secrets Manager to keep data traffic within the AWS network and avoid public internet exposure. Combine VPC endpoint policies with S3 bucket policies to restrict access to traffic from endpoint principals.

Common Pitfalls and Decision Criteria

Redshift encryption cannot be enabled on an existing unencrypted cluster; restore from a snapshot into a new cluster with –kms-key-id to create an encrypted cluster.
KMS key policies must explicitly grant the AWS data service principal (e.g., glue.amazonaws.com, redshift.amazonaws.com) permission for GenerateDataKey/Decrypt; IAM role permissions alone are insufficient.
Lake Formation and IAM permissions are both evaluated—if either denies access or lacks required grants, access will be blocked; grant both IAM role S3 access and Lake Formation table/column rights.
S3 bucket policies with an explicit Deny will override IAM Allows; audit bucket policies for Deny statements that unintentionally block service roles or cross-account access.
VPC endpoint policies or endpoint misconfiguration can silently block service traffic; validate endpoint principal and route table associations for gateway endpoints and security groups for interface endpoints.
Macie requires read access to S3 and proper bucket policies; ensure Macie’s service principal is allowed or run scans from a role with necessary permissions.

Practical Problem: Use-Case Scenario

Acme Health Analytics stores patient CSVs in an S3 data lake and must provide analysts access to de-identified fields while retaining the ability to run aggregate queries; traffic must never traverse the public internet.

Register the S3 data lake locations in Lake Formation and create a dedicated data lake admin role.
Configure bucket default encryption with SSE-KMS and create a KMS key whose key policy explicitly grants Glue, Athena, and Redshift service principals and the analyst IAM roles access.
Use Lake Formation to grant table-level SELECT to analysts but apply column-level denies for PII columns and create row-level filters if multi-tenant segmentation is required.
Run Macie classification jobs to discover any remaining PII in the buckets and remediate by masking/tokenizing in Glue ETL jobs; use client-side or tokenization patterns for reversible tokens and hash for irreversible masking.
Create an S3 gateway VPC endpoint and interface endpoints for Glue and Secrets Manager; apply endpoint policies to restrict access to VPC traffic and adjust S3 bucket policies to permit only the endpoint principal.

AWS best-practice rationale: combine KMS-backed encryption, Lake Formation fine-grained catalog controls, and private VPC endpoints to enforce defense-in-depth—encryption protects data at rest, Lake Formation controls what columns/rows are visible, and VPC endpoints avoid public network exposure while KMS policies ensure services can actually decrypt data.

← Data Query and Analytics · All domains · Data Pipeline Monitoring and Troubleshooting →

Practice these questions → · Timed practice on ExamRoll.io →