2.4.6. Masking, Redaction, and Anonymization
💡 First Principle: Sensitive data must be removed before it becomes part of something you cannot easily edit. A value masked in a source file costs one reprocessing run to fix; a value embedded into a vector index or learned into model weights may require re-ingestion or retraining — and a model can reproduce a memorized training value verbatim.
2.3.4 introduced encryption and detection (Amazon Macie finds sensitive data in S3). Detection tells you where sensitive data is; this subsection is about transforming it. The terms are not interchangeable:
| Technique | What happens to the value | Reversible? | Typical use |
|---|---|---|---|
| Masking | Characters replaced (****-****-****-1111) or value replaced by its type ([NAME], {EMAIL}) | No (unless the original is kept elsewhere) | Text for FM training or RAG where the entity type still carries meaning |
| Redaction | Value removed or blacked out | No | Documents and transcripts shared beyond the original audience |
| Hashing / pseudonymization | Value replaced by a consistent surrogate (SHA-256 hash, token) | Only with the mapping or by brute force of small value spaces | Joining records about the same person without exposing identity |
| Anonymization | Data transformed so individuals cannot reasonably be re-identified, including via combinations of quasi-identifiers | No | Datasets released or used broadly |
AWS tools and where they fit:
| Tool | Data | Capability |
|---|---|---|
| Amazon Comprehend PII | English or Spanish text | Real-time detection (up to 100 KB per document) returns entity types and offsets; redaction requires an asynchronous batch job, with MaskMode of MASK (a mask character) or REPLACE_WITH_PII_ENTITY_TYPE |
| Amazon Comprehend Medical | Clinical text | DetectPHI finds protected health information (names, ages, dates, IDs, addresses, professions) with confidence scores; AWS recommends additional human review for compliance use |
| AWS Glue Detect PII transform | Tabular data in ETL jobs | Scan every cell or sample columns; actions include redact, partial redact, SHA-256 hash, or enrich with detection results; custom regex patterns with context words |
| Amazon Transcribe PII redaction | Audio transcripts | Produces a redacted transcript, optionally alongside an unredacted one; AWS notes it does not meet HIPAA de-identification requirements on its own |
| Amazon Bedrock Guardrails sensitive information filters | Prompts and model responses at runtime | Per PII type or custom regex: BLOCK, ANONYMIZE (replaced with {NAME}, {EMAIL}), or NONE (detect only) |
Choosing the point of control. Use batch tools (Comprehend jobs, Glue, Transcribe) to clean datasets and corpora before training or ingestion; use Guardrails to protect live traffic. Guardrails masking does not rewrite everything: model invocation logs in CloudWatch Logs still contain the original request, so protect those with CloudWatch Logs data protection.
Anonymization is more than PII entity removal. Removing names and IDs can still leave quasi-identifiers — a rare job title plus a small town plus an exact date — that re-identify someone. Generalize them (age bands instead of birth dates, region instead of address) and consider whether free-text fields need summarization or removal. ML-based detectors are probabilistic, so pair them with confidence thresholds, deterministic regex for known formats (account numbers, internal IDs) and sampling review.
⚠️ Exam Trap: Encryption (2.3.4) protects data from people who should not access it; masking protects data from people and models that are allowed to access the dataset. A fine-tuning dataset encrypted with a customer managed KMS key still teaches the model every account number inside it. When the stem says the model or its users must not see personal values, the answer is masking or redaction before training, not stronger encryption.
