Data Privacy and Governance — DEA-C01 Study Guide

Bundled into the existing AWS Certified Data Engineer - Associate premium course — no separate purchase.

Included in this chapter:

Mechanism	What it governs	Scope of reach	Best for
Redshift datashare	Live, read/write access to warehouse objects	Clusters, serverless workgroups, accounts, Regions	Sharing live Redshift data with no copy
AWS Data Exchange	Licensed subscription to a published dataset	External subscribers, billed via AWS	Selling or licensing data to third parties
Lake Formation cross-account (LF-Tags)	Fine-grained catalog access shared via AWS RAM	Other accounts, down to column and row	Tag-driven sharing of data-lake tables at scale
Region-deny SCP (aws:RequestedRegion)	Where resources may exist or be replicated	Org root or OU, all member accounts	Enforcing data residency and sovereignty
Amazon Macie	Discovery and classification of sensitive data	S3 estate, automated or job-based	Locating and reporting PII before governing it
AWS Config conformance pack	Configuration compliance against rules	Account or whole AWS Organization	Continuous, auditable governance evidence

Cheat sheet

Use Amazon Macie to discover and classify sensitive data in S3
Automated discovery samples the whole estate; a discovery job goes deep on chosen buckets
Macie matches with managed identifiers, custom identifiers, or both, refined by allow lists
Macie publishes findings to Security Hub in ASFF and to EventBridge as a separate destination
Share live Redshift data with a datashare instead of copying it
Redshift datashares now support writes, not only reads
License a Redshift dataset to outside subscribers through AWS Data Exchange
Share data-lake tables across accounts with Lake Formation LF-Tags through AWS RAM
Enforce data residency with a Region-deny SCP on aws:RequestedRegion
Exempt global services from a Region-deny SCP
SCPs never affect the management account, so enforce residency through member accounts
Block backups and replicas to disallowed Regions with AWS Backup Region controls
Track resource configuration and compliance over time with AWS Config
Deploy a conformance pack to operate many Config rules as one governed framework
Govern data access through Amazon SageMaker Catalog projects
Sensitive data findings differ from sensitive data discovery results in Macie
Combine privacy and governance controls; they answer different requirements
Glue 5.0 captures data lineage with built-in OpenLineage sent to Amazon DataZone

Unlock with Premium — includes all practice exams and the complete study guide.

Cheat sheet