5.6. Reflection Checkpoint
Without security fundamentals, you will struggle with 18% of exam questions — and security errors in production can be career-ending. Imagine accidentally exposing a customer database because you confused SCPs with IAM policies. Think of security like building layers of a castle: moat (network), walls (encryption), guards (IAM), and watchtowers (audit).
Key Takeaways
Before proceeding, ensure you can:
- Explain IAM policy evaluation order (explicit Deny → Allow → implicit Deny) and design least-privilege policies
- Configure VPC endpoints, security groups, and Secrets Manager for secure data pipeline access
- Compare RBAC vs ABAC and explain when tag-based access control scales better
- Implement Lake Formation column-level and row-level security for fine-grained access
- Choose the right encryption method for S3 (SSE-S3, SSE-KMS, SSE-C, CSE) based on requirements
- Distinguish between masking, anonymization, and pseudonymization for PII protection
- Use CloudTrail for API auditing and CloudWatch Logs for application auditing
- Detect PII with Macie, enforce sovereignty with SCPs, and monitor compliance with Config
Connecting Forward
You've now covered all four exam domains. Phase 6 consolidates everything into exam readiness — decision trees for quick service selection, a comprehensive quick reference, and mixed-topic practice questions that simulate the real exam experience.
Self-Check Questions
-
A data lake in S3 contains tables with mixed sensitivity levels — some tables have PII columns, others don't. The security team requires: (a) all data encrypted at rest with auditable key usage, (b) PII columns accessible only to specific roles, (c) PII automatically detected in new datasets, (d) all data access logged and queryable. Design the security architecture using specific AWS services for each requirement.
-
An organization uses Lake Formation to manage data lake permissions. A new analyst joins the finance team and needs access to all finance-related tables (currently 50 tables, growing). What's the most scalable approach to grant and maintain this access as new tables are added?
