Security & Governance

Who you are, what you may touch, encryption and masking, audit logs, and privacy duties — 18%

• Authentication and Authorization over Data — Who you are and what you may touch, at data granularity. IAM roles and role chaining for pipelines, IAM Identity Center for human access, Lake Formation permissions down to column and row, Redshift and Athena access models, and the resource policies that catch people out on cross-account reads. (4 lessons, 60 min)
• Encryption and Masking — Protecting the data itself: encryption at rest across S3, Redshift, DynamoDB and RDS, encryption in transit and where it is not automatic, KMS keys and who can use them, and the masking and tokenisation choices — dynamic masking, column-level redaction, and detecting sensitive data before it spreads. (5 lessons, 55 min)
• Audit Logs and Privacy — Proving it afterwards. CloudTrail management and data events over data stores, the service-native logs that answer questions CloudTrail cannot, centralising and querying logs for an audit, and the privacy duties — residency, retention, deletion requests, and lineage as evidence — that turn governance from a policy document into a pipeline requirement. (4 lessons, 55 min)