Encryption and Masking

Protecting the data itself: encryption at rest across S3, Redshift, DynamoDB and RDS, encryption in transit and where it is not automatic, KMS keys and who can use them, and the masking and tokenisation choices — dynamic masking, column-level redaction, and detecting sensitive data before it spreads.

Content current as of 2026-10.

Lessons

  1. Encryption at rest across the stores
  2. Encryption in transit
  3. KMS keys and who may use them
  4. Masking, redaction, and tokenisation
  5. Finding sensitive data with Macie

Sources