🔒 AWS Data Security Interview

Comprehensive interview preparation for data security, compliance, governance, and best practices on AWS.

Module: AWS Data Engineering • Topic 55 of 65 • Premium Content

Security Architecture Overview

Architecture Diagram

┌─────────────────────────────────────────────────────────────────────┐
│                    AWS Security Architecture                        │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│  Identity & Access     Data Protection       Network Security     │
│  ┌──────────────┐     ┌──────────────┐      ┌──────────────┐     │
│  │ IAM          │     │ Encryption   │      │ VPC          │     │
│  │ Cognito      │     │ KMS          │      │ Security Grps│     │
│  │ SSO          │     │ Secrets Mgr  │      │ NACLs        │     │
│  └──────────────┘     └──────────────┘      └──────────────┘     │
│                                                                     │
│  Monitoring            Governance          Compliance              │
│  ┌──────────────┐     ┌──────────────┐      ┌──────────────┐     │
│  │ CloudTrail   │     │ Config       │      │ Artifact     │     │
│  │ GuardDuty    │     │ Lake Form.   │      │ Audit Manager│     │
│  │ Security Hub │     │ Data Catalog │      │ Macie        │     │
│  └──────────────┘     └──────────────┘      └──────────────┘     │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘

Q1: How do you implement the principle of least privilege in AWS?

Answer:

Least Privilege Implementation:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::data-lake",
                "arn:aws:s3:::data-lake/sales/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:PrincipalTag/Department": "sales"
                }
            }
        }
    ]
}

IAM Best Practices:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Least Privilege Implementation                     │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  1. Start with Minimum Permissions                            │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ • Begin with no access                                   │   │
│  │ • Add permissions as needed                              │   │
│  │ • Use IAM Access Analyzer to identify unused permissions│   │
│  └─────────────────────────────────────────────────────────┘   │
│                                                                 │
│  2. Use Conditions for Fine-Grained Control                   │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ • Resource-based conditions                              │   │
│  │ • Request-based conditions                               │   │
│  │ • Tag-based conditions                                   │   │
│  └─────────────────────────────────────────────────────────┘   │
│                                                                 │
│  3. Regular Access Reviews                                     │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ • IAM Access Analyzer reports                            │   │
│  │ • CloudTrail audit logs                                  │   │
│  │ • Quarterly access reviews                               │   │
│  └─────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘

Q2: How do you implement encryption at rest and in transit?

Answer:

Encryption Strategies:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Encryption Architecture                            │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  At Rest                                                       │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ S3: SSE-S3, SSE-KMS, SSE-C                             │   │
│  │ EBS: AES-256 (default)                                  │   │
│  │ RDS: KMS encryption                                     │   │
│  │ Redshift: KMS or hardware security modules              │   │
│  └─────────────────────────────────────────────────────────┘   │
│                                                                 │
│  In Transit                                                    │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ TLS 1.2/1.3 for all API calls                           │   │
│  │ SSL/TLS for database connections                         │   │
│  │ VPC endpoints for private communication                  │   │
│  │ VPN for hybrid connectivity                              │   │
│  └─────────────────────────────────────────────────────────┘   │
│                                                                 │
│  Column-Level Encryption                                        │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ Redshift: ENCODE directive                               │   │
│  │ DynamoDB: Client-side encryption                         │   │
│  │ Kinesis: Encryption at rest                              │   │
│  └─────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘

S3 Encryption Configuration:

# Default encryption
s3 = boto3.client('s3')

s3.put_bucket_encryption(
    Bucket='data-lake-bucket',
    ServerSideEncryptionConfiguration={
        'Rules': [
            {
                'ApplyServerSideEncryptionByDefault': {
                    'SSEAlgorithm': 'aws:kms',
                    'KMSMasterKeyID': 'arn:aws:kms:us-east-1:123456789:key/key-id'
                },
                'BucketKeyEnabled': True
            }
        ]
    }
)

# Require encryption in bucket policy
bucket_policy = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::data-lake/*",
            "Condition": {
                "StringNotEquals": {
                    "s3:x-amz-server-side-encryption": "aws:kms"
                }
            }
        }
    ]
}

Redshift Column Encryption:

-- Create table with column encryption
CREATE TABLE customers (
    customer_id INT,
    name VARCHAR(100),
    email VARCHAR(200),
    ssn VARCHAR(11) ENCODE LZO,
    credit_card VARCHAR(19) ENCODE az64
)
DISTSTYLE KEY
DISTKEY(customer_id);

Q3: How do you implement data masking and tokenization?

Answer:

Data Masking Patterns:

# Dynamic data masking
class DataMasker:
    def __init__(self):
        self.masking_rules = {
            'email': self.mask_email,
            'ssn': self.mask_ssn,
            'credit_card': self.mask_credit_card,
            'phone': self.mask_phone
        }
    
    def mask_email(self, value):
        if not value:
            return value
        local, domain = value.split('@')
        masked_local = local[0] + '*' * (len(local) - 2) + local[-1]
        return f"{masked_local}@{domain}"
    
    def mask_ssn(self, value):
        if not value:
            return value
        return f"***-**-{value[-4:]}"
    
    def mask_credit_card(self, value):
        if not value:
            return value
        return f"****-****-****-{value[-4:]}"
    
    def mask_phone(self, value):
        if not value:
            return value
        return f"***-***-{value[-4:]}"

Tokenization Service:

import hashlib
import secrets

class TokenizationService:
    def __init__(self):
        self.token_store = {}
        self.reverse_store = {}
    
    def tokenize(self, sensitive_value):
        # Generate token
        token = secrets.token_hex(16)
        
        # Store mapping
        self.token_store[token] = sensitive_value
        self.reverse_store[敏感_value] = token
        
        return token
    
    def detokenize(self, token):
        return self.token_store.get(token)
    
    def hash_tokenize(self, sensitive_value):
        # One-way tokenization using SHA-256
        salt = secrets.token_hex(16)
        hash_value = hashlib.sha256(
            f"{salt}:{sensitive_value}".encode()
        ).hexdigest()
        
        return f"{salt}:{hash_value}"

AWS Glue Data Masking:

from pyspark.sql.functions import udf, col
from pyspark.sql.types import StringType

@udf(returnType=StringType())
def mask_pii(value, mask_type):
    if not value:
        return value
    
    if mask_type == 'email':
        local, domain = value.split('@')
        return f"{local[0]}***@{domain}"
    elif mask_type == 'ssn':
        return f"***-**-{value[-4:]}"
    elif mask_type == 'name':
        return value[0] + '*' * (len(value) - 1)
    
    return value

# Apply masking
df = df.withColumn(
    "masked_email",
    mask_pii(col("email"), lit("email"))
)

Q4: How do you implement compliance frameworks (GDPR, HIPAA, PCI)?

Answer:

Compliance Architecture:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Compliance Framework Implementation                │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  GDPR Requirements        AWS Services         Implementation  │
│  ┌──────────────────┐    ┌──────────────────┐ ┌──────────────┐│
│  │ Right to Erasure │───▶│ S3 Delete/Lifecycle││ Automated   ││
│  │ Data Portability │───▶│ Athena/Glue Export ││ Deletion    ││
│  │ Consent Mgmt     │───▶│ DynamoDB          ││             ││
│  └──────────────────┘    └──────────────────┘ └──────────────┘│
│                                                                 │
│  HIPAA Requirements       AWS Services         Implementation  │
│  ┌──────────────────┐    ┌──────────────────┐ ┌──────────────┐│
│  │ Access Controls  │───▶│ IAM/Lake Form.   ││ BA with AWS  ││
│  │ Audit Logging    │───▶│ CloudTrail       ││ Encryption   ││
│  │ Encryption       │───▶│ KMS              ││             ││
│  └──────────────────┘    └──────────────────┘ └──────────────┘│
│                                                                 │
│  PCI DSS Requirements     AWS Services         Implementation  │
│  ┌──────────────────┐    ┌──────────────────┐ ┌──────────────┐│
│  │ Network Security │───▶│ VPC/Security Grp ││ Quarterly   ││
│  │ Access Control   │───▶│ IAM              ││ Pen Tests   ││
│  │ Encryption       │───▶│ KMS              ││             ││
│  └──────────────────┘    └──────────────────┘ └──────────────┘│
└─────────────────────────────────────────────────────────────────┘

GDPR Right to Erasure Implementation:

class GDPRErasure:
    def __init__(self):
        self.data_stores = {
            's3': self.erase_s3_data,
            'dynamodb': self.erase_dynamodb_data,
            'redshift': self.erase_redshift_data
        }
    
    def erase_user_data(self, user_id):
        results = {}
        
        for store, erase_func in self.data_stores.items():
            try:
                erase_func(user_id)
                results[store] = 'success'
            except Exception as e:
                results[store] = f'error: {str(e)}'
        
        # Log erasure for audit
        self.log_erasure(user_id, results)
        
        return results
    
    def erase_s3_data(self, user_id):
        s3 = boto3.client('s3')
        
        # Find and delete user data
        paginator = s3.get_paginator('list_objects_v2')
        pages = paginator.paginate(Bucket='data-lake')
        
        for page in pages:
            for obj in page.get('Contents', []):
                if user_id in obj['Key']:
                    s3.delete_object(
                        Bucket='data-lake',
                        Key=obj['Key']
                    )
    
    def log_erasure(self, user_id, results):
        # Log for compliance audit
        dynamodb = boto3.resource('dynamodb')
        table = dynamodb.Table('gdpr_audit_log')
        
        table.put_item(
            Item={
                'user_id': user_id,
                'action': 'DATA_ERASURE',
                'timestamp': datetime.now().isoformat(),
                'results': results
            }
        )

Q5: How do you implement audit logging and monitoring?

Answer:

Audit Architecture:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Audit Logging Architecture                         │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  CloudTrail            CloudWatch           Security Hub        │
│  ┌─────────────┐      ┌─────────────┐     ┌─────────────┐     │
│  │ API Logs    │─────▶│ Log Groups  │────▶│ Aggregated  │     │
│  │             │      │ Metrics     │     │ Findings    │     │
│  └─────────────┘      └─────────────┘     └─────────────┘     │
│         │                    │                    │             │
│         ▼                    ▼                    ▼             │
│  ┌─────────────┐      ┌─────────────┐     ┌─────────────┐     │
│  │ S3 Logs     │      │ Alarms      │     │ Compliance  │     │
│  │ (Central)   │      │             │     │ Dashboard   │     │
│  └─────────────┘      └─────────────┘     └─────────────┘     │
└─────────────────────────────────────────────────────────────────┘

CloudTrail Configuration:

# Create CloudTrail
cloudtrail = boto3.client('cloudtrail')

cloudtrail.create_trail(
    Name='data-audit-trail',
    S3BucketName='audit-logs-bucket',
    IncludeGlobalServiceEvents=True,
    IsMultiRegionTrail=True,
    EnableLogFileValidation=True
)

cloudtrail.start_logging(Name='data-audit-trail')

# S3 data event logging
cloudtrail.put_event_selectors(
    TrailName='data-audit-trail',
    EventSelectors=[
        {
            'ReadWriteType': 'All',
            'IncludeManagementEvents': True,
            'DataResources': [
                {
                    'Type': 'AWS::S3::Object',
                    'Values': ['arn:aws:s3:::data-lake/']
                },
                {
                    'Type': 'AWS::Lambda::Function',
                    'Values': ['arn:aws:lambda:us-east-1:123456789:function:']
                }
            ]
        }
    ]
)

Custom Audit Events:

class AuditLogger:
    def __init__(self):
        self.cloudwatch = boto3.client('cloudwatch')
    
    def log_data_access(self, user_id, resource, action, details):
        # CloudWatch metric for auditing
        self.cloudwatch.put_metric_data(
            Namespace='DataAudit',
            MetricData=[
                {
                    'MetricName': 'DataAccess',
                    'Dimensions': [
                        {'Name': 'UserId', 'Value': user_id},
                        {'Name': 'Resource', 'Value': resource},
                        {'Name': 'Action', 'Value': action}
                    ],
                    'Value': 1,
                    'Unit': 'Count'
                }
            ]
        )
        
        # Structured log for CloudWatch Logs
        log_entry = {
            'timestamp': datetime.now().isoformat(),
            'user_id': user_id,
            'resource': resource,
            'action': action,
            'details': details
        }
        
        print(json.dumps(log_entry))

Q6: How do you implement network security for data pipelines?

Answer:

Network Security Architecture:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Network Security Architecture                      │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Public Subnet           Private Subnet                        │
│  ┌─────────────────────┐ ┌─────────────────────────────────┐  │
│  │ ┌─────────────────┐ │ │ ┌─────────────────────────────┐ │  │
│  │ │ Load Balancer   │ │ │ │ EMR Cluster                 │ │  │
│  │ │ (Public)        │ │ │ │ (Private)                   │ │  │
│  │ └─────────────────┘ │ │ └─────────────────────────────┘ │  │
│  │ ┌─────────────────┐ │ │ ┌─────────────────────────────┐ │  │
│  │ │ NAT Gateway     │ │ │ │ Redshift Cluster            │ │  │
│  │ │                 │ │ │ │ (Private)                   │ │  │
│  │ └─────────────────┘ │ │ └─────────────────────────────┘ │  │
│  └─────────────────────┘ └─────────────────────────────────┘  │
│                                                                 │
│  VPC Endpoints                                                  │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ S3 Gateway Endpoint                                       │   │
│  │ DynamoDB Gateway Endpoint                                 │   │
│  │ Interface Endpoints (Glue, KMS, etc.)                    │   │
│  └─────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘

VPC Configuration:

# Create VPC endpoint for S3
ec2 = boto3.client('ec2')

ec2.create_vpc_endpoint(
    VpcId='vpc-12345678',
    ServiceName='com.amazonaws.us-east-1.s3',
    RouteTableIds=['rtb-12345678'],
    PolicyDocument=json.dumps({
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": "*",
                "Action": [
                    "s3:GetObject",
                    "s3:ListBucket"
                ],
                "Resource": [
                    "arn:aws:s3:::data-lake",
                    "arn:aws:s3:::data-lake/*"
                ]
            }
        ]
    })
)

# Security group for data pipeline
ec2.create_security_group(
    GroupName='data-pipeline-sg',
    Description='Security group for data pipeline',
    VpcId='vpc-12345678'
)

# Restrict access
ec2.authorize_security_group_ingress(
    GroupId='sg-12345678',
    IpPermissions=[
        {
            'IpProtocol': 'tcp',
            'FromPort': 443,
            'ToPort': 443,
            'UserIdGroupPairs': [
                {'GroupId': 'sg-87654321'}  # Only from trusted SG
            ]
        }
    ]
)

Q7: How do you implement secrets management?

Answer:

Secrets Management Architecture:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Secrets Management Architecture                    │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  AWS Secrets Manager     AWS Systems Manager                   │
│  ┌─────────────────────┐ ┌─────────────────────┐              │
│  │ • Database creds    │ │ • Parameter Store   │              │
│  │ • API keys          │ │ • String/Secure     │              │
│  │ • Certificates      │ │ • Hierarchical      │              │
│  │ • Automatic rotation│ │ • Encryption        │              │
│  └──────────┬──────────┘ └──────────┬──────────┘              │
│             │                       │                          │
│             └───────────┬───────────┘                          │
│                         ▼                                      │
│              ┌─────────────────────┐                           │
│              │     Applications    │                           │
│              │  (Lambda, ECS, etc) │                           │
│              └─────────────────────┘                           │
└─────────────────────────────────────────────────────────────────┘

Secrets Manager Implementation:

import boto3
import json

secrets_client = boto3.client('secretsmanager')

# Store secret
def store_secret(secret_name, secret_value):
    secrets_client.create_secret(
        Name=secret_name,
        Description='Database credentials',
        SecretString=json.dumps(secret_value),
        Tags=[
            {'Key': 'Environment', 'Value': 'production'},
            {'Key': 'Service', 'Value': 'data-pipeline'}
        ]
    )

# Retrieve secret
def get_secret(secret_name):
    response = secrets_client.get_secret_value(SecretId=secret_name)
    return json.loads(response['SecretString'])

# Rotate secret
def rotate_secret(secret_id):
    secrets_client.rotate_secret(
        SecretId=secret_id,
        RotationLambdaARN='arn:aws:lambda:rotate-function',
        RotationRules={
            'AutomaticallyAfterDays': 30
        }
    )

Lambda Secrets Rotation:

def lambda_handler(event, context):
    secret = event['SecretId']
    token = event['ClientRequestToken']
    step = event['Step']
    
    if step == 'createSecret':
        # Generate new secret
        new_password = generate_password()
        secrets_client.put_secret_value(
            SecretId=secret,
            ClientRequestToken=token,
            SecretString=json.dumps({'password': new_password}),
            VersionStages=['AWSPENDING']
        )
    
    elif step == 'setSecret':
        # Set secret in RDS
        connection = get_rds_connection()
        connection.execute(
            "ALTER USER admin IDENTIFIED BY %s",
            (new_password,)
        )
    
    elif step == 'testSecret':
        # Test new secret
        connection = get_rds_connection()
        connection.ping()
    
    elif step == 'finishSecret':
        # Finalize rotation
        secrets_client.update_secret_version_stage(
            SecretId=secret,
            VersionStage='AWSCURRENT',
            MoveToVersionId=token,
            RemoveFromVersionId=previous_version
        )

Q8: How do you implement data classification?

Answer:

Data Classification Framework:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Data Classification Framework                      │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Classification Levels                                        │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ Public        - No restrictions                         │   │
│  │ Internal      - Employees only                          │   │
│  │ Confidential  - Limited access                          │   │
│  │ Restricted    - Highly sensitive, strict controls       │   │
│  └─────────────────────────────────────────────────────────┘   │
│                                                                 │
│  Data Types                                                     │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ PII    - Personal Identifiable Information              │   │
│  │ PHI    - Protected Health Information                   │   │
│  │ PCI    - Payment Card Industry                          │   │
│  │ IP     - Intellectual Property                          │   │
│  └─────────────────────────────────────────────────────────┘   │
│                                                                 │
│  AWS Services                                                   │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ Macie      - S3 sensitive data discovery                │   │
│  │ Glue       - Data Catalog classifications               │   │
│  │ Lake Form. - Fine-grained permissions                   │   │
│  └─────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘

Amazon Macie Implementation:

# Enable Macie
macie = boto3.client('macie2')

macie.create_classification_job(
    jobType='ONE_TIME',
    name='sensitive-data-scan',
    s3JobDefinition={
        'bucketDefinitions': [
            {
                'accountId': '123456789',
                'buckets': ['data-lake-bucket']
            }
        ],
        'scoping': {
            'includes': {
                'and': [
                    {
                        'simpleScopeTerm': {
                            'comparator': 'STARTS_WITH',
                            'key': 'PREFIX',
                            'value': 'sensitive/'
                        }
                    }
                ]
            }
        }
    },
    customDataIdentifierIds=['pii-detector']
)

# Custom data identifier
macie.create_custom_data_identifier(
    name='email-detector',
    regex='[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}',
    description='Detects email addresses',
    severityLevels=[
        {'severity': 5, 'description': 'Low'},
        {'severity': 10, 'description': 'Medium'}
    ]
)

Q9: How do you implement incident response for data breaches?

Answer:

Incident Response Architecture:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Incident Response Architecture                     │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Detection          Analysis           Containment             │
│  ┌─────────────┐   ┌─────────────┐    ┌─────────────┐         │
│  │ GuardDuty   │──▶│ Security    │───▶│ Isolate     │         │
│  │ Macie       │   │ Hub         │    │ Resources   │         │
│  │ CloudWatch  │   │             │    │             │         │
│  └─────────────┘   └─────────────┘    └─────────────┘         │
│                                                                 │
│  Eradication        Recovery            Post-Incident          │
│  ┌─────────────┐   ┌─────────────┐    ┌─────────────┐         │
│  │ Remove      │──▶│ Restore     │───▶│ Lessons     │         │
│  │ Threat      │   │ Services    │    │ Learned     │         │
│  └─────────────┘   └─────────────┘    └─────────────┘         │
└─────────────────────────────────────────────────────────────────┘

GuardDuty Integration:

# Enable GuardDuty
guardduty = boto3.client('guardduty')

# Create detector
detector = guardduty.create_detector(
    Enable=True,
    FindingPublishingFrequency='FIFTEEN_MINUTES',
    DataSources={
        'S3Logs': {'Enable': True},
        'Kubernetes': {'AuditLogs': {'Enable': True}},
        'MalwareProtection': {'ScanEc2InstanceWithFindings': {'EbsVolumes': {'Enable': True}}}
    }
)

# Automated response
def lambda_handler(event, context):
    # Parse GuardDuty finding
    finding = json.loads(event['Records'][0]['Sns']['Message'])
    
    severity = finding['severity']
    resource = finding['resource']
    
    # High severity - immediate response
    if severity >= 8:
        # Isolate EC2 instance
        ec2 = boto3.client('ec2')
        instance_id = resource['instanceDetails']['instanceId']
        
        # Apply quarantine security group
        ec2.modify_instance_attribute(
            InstanceId=instance_id,
            Groups=['quarantine-sg']
        )
        
        # Snapshot EBS volumes for forensics
        ec2.create_snapshot(
            VolumeId=volume_id,
            Description=f'Forensics snapshot for finding {finding["id"]}'
        )
        
        # Notify security team
        notify_security_team(finding)

Q10: How do you implement data loss prevention (DLP)?

Answer:

DLP Architecture:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Data Loss Prevention Architecture                  │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Data Discovery         Classification       Protection        │
│  ┌─────────────┐       ┌─────────────┐     ┌─────────────┐    │
│  │ Macie       │──────▶│ Glue Data   │────▶│ Lake Form.  │    │
│  │ Inspector   │       │ Catalog     │     │ S3 Policies │    │
│  └─────────────┘       └─────────────┘     └─────────────┘    │
│                                                                 │
│  Monitoring            Response            Prevention          │
│  ┌─────────────┐       ┌─────────────┐     ┌─────────────┐    │
│  │ CloudWatch  │──────▶│ Lambda      │────▶│ IAM         │    │
│  │ Events      │       │ Functions   │     │ SCPs        │    │
│  └─────────────┘       └─────────────┘     └─────────────┘    │
└─────────────────────────────────────────────────────────────────┘

S3 DLP Policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyPublicAccess",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::sensitive-data",
                "arn:aws:s3:::sensitive-data/*"
            ],
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        },
        {
            "Sid": "RequireEncryption",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::sensitive-data/*",
            "Condition": {
                "StringNotEquals": {
                    "s3:x-amz-server-side-encryption": "aws:kms"
                }
            }
        }
    ]
}

Q11: How do you implement zero trust architecture?

Answer:

Zero Trust Components:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Zero Trust Architecture                            │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Identity Verification                                        │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ • Multi-factor authentication                           │   │
│  │ • Certificate-based authentication                      │   │
│  │ • Continuous authentication                             │   │
│  └─────────────────────────────────────────────────────────┘   │
│                                                                 │
│  Device Verification                                          │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ • Device posture checks                                 │   │
│  │ • Patch compliance                                      │   │
│  │ • Endpoint detection                                    │   │
│  └─────────────────────────────────────────────────────────┘   │
│                                                                 │
│  Network Micro-Segmentation                                   │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ • VPC per workload                                      │   │
│  │ • Security groups as firewalls                          │   │
│  │ • Network policies                                      │   │
│  └─────────────────────────────────────────────────────────┘   │
│                                                                 │
│  Continuous Monitoring                                        │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ • Behavior analytics                                    │   │
│  │ • Anomaly detection                                     │   │
│  │ • Real-time threat intelligence                         │   │
│  └─────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘

IAM Identity Center Implementation:

# Configure SSO
sso_admin = boto3.client('sso-admin')

# Create permission set
sso_admin.create_permission_set(
    Name='DataEngineerAccess',
    Description='Access for data engineers',
    SessionDuration='PT8H',
    ManagedPolicies=[
        'arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess',
        'arn:aws:iam::aws:policy/AWSGlueConsoleFullAccess'
    ]
)

# Assign users
sso_admin.create_account_assignment(
    InstanceArn='arn:aws:sso:::instance/ssoins-12345678',
    TargetId='123456789012',
    TargetType='AWS_ACCOUNT',
    PrincipalType='USER',
    PrincipalId='user-id',
    PermissionSetArn='arn:aws:sso:::permissionSet/ssoins-12345678/ps-12345678'
)

Q12: How do you implement data residency requirements?

Answer:

Data Residency Architecture:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Data Residency Implementation                      │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Regional Requirements                                        │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ EU: Data must stay in EU (GDPR)                         │   │
│  │ China: Data must stay in China (China regulations)      │   │
│  │ Russia: Data must stay in Russia (Data localization)    │   │
│  └─────────────────────────────────────────────────────────┘   │
│                                                                 │
│  AWS Implementation                                            │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ • Region-specific resources                             │   │
│  │ • SCPs to prevent region movement                       │   │
│  │ • Cross-region replication controls                     │   │
│  └─────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘

Service Control Policy (SCP):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyNonEURegions",
            "Effect": "Deny",
            "NotAction": [
                "iam:*",
                "sts:*",
                "organizations:*",
                "account:*"
            ],
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "aws:RequestedRegion": [
                        "eu-west-1",
                        "eu-west-2",
                        "eu-west-3",
                        "eu-central-1"
                    ]
                }
            }
        }
    ]
}

Q13: How do you implement security monitoring and alerting?

Answer:

Security Monitoring Architecture:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Security Monitoring Architecture                   │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Data Sources          Collection          Analysis            │
│  ┌─────────────┐      ┌─────────────┐    ┌─────────────┐      │
│  │ VPC Flow    │─────▶│ CloudWatch  │───▶│ Security    │      │
│  │ CloudTrail  │      │ Logs        │    │ Hub         │      │
│  │ GuardDuty   │      │             │    │             │      │
│  └─────────────┘      └─────────────┘    └──────┬──────┘      │
│                                                  │              │
│                                                  ▼              │
│  ┌─────────────┐      ┌─────────────┐    ┌─────────────┐      │
│  │ SNS         │◀─────│ Lambda      │◀───│ Detective   │      │
│  │ Alerts      │      │ Actions     │    │             │      │
│  └─────────────┘      └─────────────┘    └─────────────┘      │
└─────────────────────────────────────────────────────────────────┘

Security Hub Integration:

# Enable Security Hub
securityhub = boto3.client('securityhub')

securityhub.enable_security_hub(
    Tags={
        'Environment': 'production'
    }
)

# Custom insight
securityhub.create_insight(
    Name='High Severity Findings',
    Filters={
        'SeverityNormalized': [{'Gte': 70}]
    },
    GroupByArn='resourceType'
)

# Automated response to findings
def lambda_handler(event, context):
    finding = json.loads(event['Records'][0]['Sns']['Message'])
    
    severity = finding['Severity']['Normalized']
    product = finding['ProductArn']
    
    # High severity - immediate action
    if severity >= 90:
        # Isolate resource
        isolate_resource(finding['Resources'][0]['Id'])
        
        # Notify SOC
        notify_soc_team(finding)
        
        # Create ticket
        create_incident_ticket(finding)
    
    # Medium severity - investigate
    elif severity >= 70:
        # Add to investigation queue
        add_to_investigation_queue(finding)
        
        # Notify security team
        notify_security_team(finding)

Q14: How do you implement secure data sharing?

Answer:

Secure Data Sharing Architecture:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Secure Data Sharing Architecture                   │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Producer Account           Consumer Account                   │
│  ┌─────────────────────┐   ┌─────────────────────┐            │
│  │ S3 Bucket           │   │ Cross-Account       │            │
│  │ (Source Data)       │   │ Access Role         │            │
│  └──────────┬──────────┘   └──────────┬──────────┘            │
│             │                         │                        │
│             │    ┌─────────────┐      │                        │
│             └───▶│ KMS         │◀─────┘                        │
│                  │ (Shared Key)│                                │
│                  └─────────────┘                                │
│                                                                 │
│  Lake Formation Sharing                                        │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ • Column-level permissions                               │   │
│  │ • Row-level filters                                      │   │
│  │ • Time-based access                                      │   │
│  └─────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘

Cross-Account KMS Key Sharing:

# Create KMS key with cross-account access
kms = boto3.client('kms')

key = kms.create_key(
    Description='Cross-account data sharing key',
    Policy=json.dumps({
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "AllowCrossAccountAccess",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::consumer-account:root"
                },
                "Action": [
                    "kms:Decrypt",
                    "kms:DescribeKey"
                ],
                "Resource": "*"
            }
        ]
    })
)

# Create alias
kms.create_alias(
    AliasName='alias/cross-account-key',
    TargetKeyId=key['KeyMetadata']['KeyId']
)

Q15: How do you implement security testing for data pipelines?

Answer:

Security Testing Framework:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Security Testing Framework                         │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Static Analysis         Dynamic Analysis       Pen Testing    │
│  ┌─────────────┐        ┌─────────────┐       ┌─────────────┐ │
│  │ Code Review │        │ DAST        │       │ Pen Tests   │ │
│  │ SAST        │        │ Fuzzing     │       │ Red Team    │ │
│  │ Dependency  │        │ Runtime     │       │             │ │
│  └─────────────┘        └─────────────┘       └─────────────┘ │
│                                                                 │
│  Compliance Scanning      Vulnerability Scanning               │
│  ┌─────────────────────┐ ┌─────────────────────┐              │
│  │ Inspector           │ │ GuardDuty           │              │
│  │ Config Rules        │ │ Macie               │              │
│  │ Security Hub        │ │ ECR Scanning        │              │
│  └─────────────────────┘ └─────────────────────┘              │
└─────────────────────────────────────────────────────────────────┘

Automated Security Scanning:

# AWS Inspector for vulnerability scanning
inspector = boto3.client('inspector2')

# Create assessment target
inspector.create_assessment_target(
    assessmentTargetName='data-pipeline-scan',
    resourceGroupArn='arn:aws:inspector2:us-east-1:123456789:resourcegroup/12345678'
)

# Schedule weekly scans
events = boto3.client('events')
events.put_rule(
    Name='WeeklySecurityScan',
    ScheduleExpression='cron(0 2 ? * SUN)',
    State='ENABLED'
)

events.put_targets(
    Rule='WeeklySecurityScan',
    Targets=[
        {
            'Id': 'SecurityScanLambda',
            'Arn': 'arn:aws:lambda:us-east-1:123456789:function:security-scan'
        }
    ]
)

Q16: How do you implement API security for data services?

Answer:

API Security Architecture:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              API Security Architecture                          │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Client              API Gateway           Backend             │
│  ┌─────────┐        ┌─────────────┐       ┌─────────────┐     │
│  │ App     │───────▶│ WAF         │──────▶│ Lambda      │     │
│  │         │        │ Throttling  │       │ (Auth)      │     │
│  │         │        │ Auth        │       │             │     │
│  └─────────┘        └─────────────┘       └─────────────┘     │
│                                                                 │
│  Security Layers                                               │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ 1. WAF - Rate limiting, IP blocking, SQL injection     │   │
│  │ 2. API Keys - Usage tracking, quotas                   │   │
│  │ 3. IAM Auth - AWS signature verification               │   │
│  │ 4. Cognito - User pools, OAuth 2.0                     │   │
│  │ 5. Lambda Authorizers - Custom auth logic              │   │
│  └─────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘

WAF Configuration:

# Create WAF Web ACL
waf = boto3.client('wafv2')

waf.create_web_acl(
    Name='data-api-protection',
    Scope='REGIONAL',
    DefaultAction={'Allow': {}},
    Rules=[
        {
            'Name': 'RateLimit',
            'Priority': 1,
            'Action': {'Block': {}},
            'Statement': {
                'RateBasedStatement': {
                    'Limit': 2000,
                    'AggregateKeyType': 'IP'
                }
            },
            'VisibilityConfig': {
                'SampledRequestsEnabled': True,
                'CloudWatchMetricsEnabled': True,
                'MetricName': 'RateLimit'
            }
        },
        {
            'Name': 'SQLInjection',
            'Priority': 2,
            'Action': {'Block': {}},
            'Statement': {
                'SqliMatchStatement': {
                    'FieldToMatch': {'Body': {}},
                    'TextTransformations': [
                        {'Priority': 0, 'Type': 'URL_DECODE'}
                    ]
                }
            },
            'VisibilityConfig': {
                'SampledRequestsEnabled': True,
                'CloudWatchMetricsEnabled': True,
                'MetricName': 'SQLInjection'
            }
        }
    ],
    VisibilityConfig={
        'SampledRequestsEnabled': True,
        'CloudWatchMetricsEnabled': True,
        'MetricName': 'DataAPIProtection'
    }
)

Q17: How do you implement compliance auditing?

Answer:

Compliance Auditing Architecture:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Compliance Auditing Architecture                   │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Config Rules          Audit Manager        Artifact           │
│  ┌─────────────┐      ┌─────────────┐      ┌─────────────┐   │
│  │ Compliance  │─────▶│ Evidence    │─────▶│ Compliance  │   │
│  │ Checks      │      │ Collection  │      │ Reports     │   │
│  └─────────────┘      └─────────────┘      └─────────────┘   │
│         │                    │                    │             │
│         ▼                    ▼                    ▼             │
│  ┌─────────────┐      ┌─────────────┐      ┌─────────────┐   │
│  │ Remediation │      │ Dashboard   │      │ External    │   │
│  │ Lambda      │      │ (QuickSight)│      │ Auditors    │   │
│  └─────────────┘      └─────────────┘      └─────────────┘   │
└─────────────────────────────────────────────────────────────────┘

AWS Config Rules:

# Create Config rule for encryption
config = boto3.client('config')

config.put_config_rule(
    ConfigRule={
        'ConfigRuleName': 's3-bucket-server-side-encryption-enabled',
        'Source': {
            'Owner': 'AWS',
            'SourceIdentifier': 'S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED'
        },
        'Scope': {
            'ComplianceResourceTypes': ['AWS::S3::Bucket']
        }
    }
)

# Create custom Config rule
config.put_config_rule(
    ConfigRule={
        'ConfigRuleName': 'data-lake-encryption-check',
        'Source': {
            'Owner': 'CUSTOM_LAMBDA',
            'SourceIdentifier': 'arn:aws:lambda:us-east-1:123456789:function:check-encryption',
            'SourceDetails': [
                {
                    'MessageSource': 'CONFIG'
                }
            ]
        }
    }
)

Q18: How do you implement disaster recovery for security infrastructure?

Answer:

Security DR Architecture:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Security Infrastructure DR                         │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Primary Region            DR Region                          │
│  ┌─────────────────────┐   ┌─────────────────────┐            │
│  │ IAM                 │   │ IAM                 │            │
│  │ (Users/Roles)       │   │ (Replicated)        │            │
│  └─────────────────────┘   └─────────────────────┘            │
│                                                                 │
│  ┌─────────────────────┐   ┌─────────────────────┐            │
│  │ KMS Keys            │   │ KMS Keys            │            │
│  │ (Primary)           │   │ (Replicated)        │            │
│  └─────────────────────┘   └─────────────────────┘            │
│                                                                 │
│  ┌─────────────────────┐   ┌─────────────────────┐            │
│  │ Security Hub        │   │ Security Hub        │            │
│  │ (Findings)          │   │ (Replicated)        │            │
│  └─────────────────────┘   └─────────────────────┘            │
└─────────────────────────────────────────────────────────────────┘

IAM DR Strategy:

# Export IAM configuration
def export_iam_config():
    iam = boto3.client('iam')
    
    # Export users
    users = iam.list_users()['Users']
    
    # Export roles
    roles = iam.list_roles()['Roles']
    
    # Export policies
    policies = iam.list_policies(Scope='Local')['Policies']
    
    # Store in S3 for DR
    s3 = boto3.client('s3')
    s3.put_object(
        Bucket='dr-config-bucket',
        Key='iam/config.json',
        Body=json.dumps({
            'users': users,
            'roles': roles,
            'policies': policies
        }, default=str)
    )

Q19: How do you implement real-time threat detection?

Answer:

Real-Time Threat Detection Architecture:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Real-Time Threat Detection                         │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Data Sources          Analysis           Response             │
│  ┌─────────────┐      ┌─────────────┐    ┌─────────────┐      │
│  │ VPC Flow    │─────▶│ GuardDuty   │───▶│ Lambda      │      │
│  │ CloudTrail  │      │ Machine     │    │ Actions     │      │
│  │ DNS Logs    │      │ Learning    │    │             │      │
│  └─────────────┘      └──────┬──────┘    └──────┬──────┘      │
│                              │                   │              │
│                              ▼                   ▼              │
│                       ┌─────────────┐    ┌─────────────┐      │
│                       │ Detective   │    │ SNS         │      │
│                       │ Investigation│   │ Alerts      │      │
│                       └─────────────┘    └─────────────┘      │
└─────────────────────────────────────────────────────────────────┘

GuardDuty Finding Response:

def lambda_handler(event, context):
    # Parse GuardDuty finding
    finding = json.loads(event['Records'][0]['Sns']['Message'])
    
    finding_type = finding['type']
    severity = finding['severity']
    
    # Categorize and respond
    if 'UnauthorizedAccess' in finding_type:
        # Potential intrusion
        response = handle_intrusion(finding)
    elif 'CryptoCurrency' in finding_type:
        # Cryptomining
        response = handle_cryptomining(finding)
    elif 'Trojan' in finding_type:
        # Malware
        response = handle_malware(finding)
    
    return response

def handle_intrusion(finding):
    instance_id = finding['resource']['instanceDetails']['instanceId']
    
    # Isolate instance
    ec2 = boto3.client('ec2')
    ec2.modify_instance_attribute(
        InstanceId=instance_id,
        Groups=['quarantine-sg']
    )
    
    # Snapshot for forensics
    volumes = ec2.describe_volumes(
        Filters=[{'Name': 'attachment.instance-id', 'Values': [instance_id]}]
    )['Volumes']
    
    for volume in volumes:
        ec2.create_snapshot(
            VolumeId=volume['VolumeId'],
            Description=f'Forensics: {finding["id"]}'
        )
    
    # Notify security team
    notify_security_team(finding, 'intrusion')

Q20: How do you implement secure DevOps for data pipelines?

Answer:

Secure DevOps Architecture:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Secure DevOps for Data Pipelines                   │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Code                Build               Deploy                │
│  ┌─────────────┐    ┌─────────────┐    ┌─────────────┐        │
│  │ Git         │───▶│ CodeBuild   │───▶│ CloudForm.  │        │
│  │ (Encrypted) │    │ (SAST)      │    │ (Review)    │        │
│  │ Secrets     │    │ Dep Scan    │    │             │        │
│  └─────────────┘    └─────────────┘    └─────────────┘        │
│         │                │                   │                  │
│         ▼                ▼                   ▼                  │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │              Security Gates                              │   │
│  │ • SAST/DAST scanning                                     │   │
│  │ • Dependency vulnerability check                         │   │
│  │ • Infrastructure as Code scanning                        │   │
│  │ • Secret detection                                       │   │
│  └─────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘

CodePipeline Security:

# Create secure pipeline
codepipeline = boto3.client('codepipeline')

pipeline = codepipeline.create_pipeline(
    pipeline={
        'name': 'secure-data-pipeline',
        'roleArn': 'arn:aws:iam::role/PipelineRole',
        'artifactStore': {
            'type': 'S3',
            'location': 'pipeline-artifacts-bucket'
        },
        'stages': [
            {
                'name': 'Source',
                'actions': [
                    {
                        'name': 'Source',
                        'actionTypeId': {
                            'category': 'Source',
                            'owner': 'AWS',
                            'provider': 'CodeCommit',
                            'version': '1'
                        },
                        'configuration': {
                            'RepositoryName': 'data-pipeline',
                            'BranchName': 'main'
                        }
                    }
                ]
            },
            {
                'name': 'Build',
                'actions': [
                    {
                        'name': 'SecurityScan',
                        'actionTypeId': {
                            'category': 'Build',
                            'owner': 'AWS',
                            'provider': 'CodeBuild',
                            'version': '1'
                        },
                        'configuration': {
                            'ProjectName': 'security-scan'
                        }
                    }
                ]
            },
            {
                'name': 'Deploy',
                'actions': [
                    {
                        'name': 'Deploy',
                        'actionTypeId': {
                            'category': 'Deploy',
                            'owner': 'AWS',
                            'provider': 'CloudFormation',
                            'version': '1'
                        },
                        'configuration': {
                            'ActionMode': 'CHANGE_SET_REPLACE',
                            'StackName': 'data-pipeline-stack',
                            'ChangeSetName': 'pipeline-changeset'
                        }
                    }
                ]
            }
        ]
    }
)

Q21: How do you implement data sovereignty?

Answer:

Data Sovereignty Architecture:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Data Sovereignty Implementation                    │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Requirements           Implementation         Controls        │
│  ┌──────────────────┐  ┌──────────────────┐  ┌──────────────┐│
│  │ EU Data          │  │ Region-specific  │  │ SCPs         ││
│  │ China Data       │  │ Resources        │  │ Config Rules ││
│  │ Russia Data      │  │ VPC Isolation    │  │ Monitoring   ││
│  └──────────────────┘  └──────────────────┘  └──────────────┘│
│                                                                 │
│  Cross-Border Restrictions                                    │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ • Block cross-region data movement                      │   │
│  │ • Encrypt data with region-specific keys                │   │
│  │ • Audit all data access patterns                        │   │
│  └─────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘

Region-Specific Implementation:

# Deploy infrastructure per region
class DataSovereigntyManager:
    def __init__(self):
        self.regions = {
            'eu': ['eu-west-1', 'eu-west-2', 'eu-central-1'],
            'china': ['cn-north-1', 'cn-northwest-1'],
            'us': ['us-east-1', 'us-west-2']
        }
    
    def deploy_region_specific(self, region_group):
        regions = self.regions[region_group]
        
        for region in regions:
            # Create region-specific resources
            self.create_s3_bucket(region)
            self.create_kms_key(region)
            self.create_vpc(region)
            self.create_redshift(region)
    
    def create_s3_bucket(self, region):
        s3 = boto3.client('s3', region_name=region)
        
        s3.create_bucket(
            Bucket=f'data-sovereign-{region}',
            CreateBucketConfiguration={
                'LocationConstraint': region
            }
        )
        
        # Apply encryption
        s3.put_bucket_encryption(
            Bucket=f'data-sovereign-{region}',
            ServerSideEncryptionConfiguration={
                'Rules': [
                    {
                        'ApplyServerSideEncryptionByDefault': {
                            'SSEAlgorithm': 'aws:kms'
                        }
                    }
                ]
            }
        )

Q22: How do you implement secure backup and recovery?

Answer:

Secure Backup Architecture:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Secure Backup Architecture                        │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Backup Sources         Backup Storage        Recovery         │
│  ┌─────────────┐       ┌─────────────┐      ┌─────────────┐   │
│  │ RDS         │──────▶│ S3          │─────▶│ Restore     │   │
│  │ Redshift    │       │ (Encrypted) │      │ (Cross-Account)│  │
│  │ EBS         │       │ (Versioned) │      │             │   │
│  └─────────────┘       └─────────────┘      └─────────────┘   │
│                                                                 │
│  Security Controls                                             │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ • Encryption at rest (KMS)                              │   │
│  │ • Access controls (IAM)                                  │   │
│  │ • Immutability (Object Lock)                             │   │
│  │ • Cross-region replication                               │   │
│  └─────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘

Immutable Backup with S3 Object Lock:

# Create bucket with Object Lock
s3 = boto3.client('s3')

s3.create_bucket(
    Bucket='immutable-backups',
    ObjectLockEnabledForBucket=True
)

# Enable versioning (required for Object Lock)
s3.put_bucket_versioning(
    Bucket='immutable-backups',
    VersioningConfiguration={'Status': 'Enabled'}
)

# Set default retention
s3.put_object_lock_configuration(
    Bucket='immutable-backups',
    ObjectLockConfiguration={
        'ObjectLockEnabled': 'Enabled',
        'Rule': {
            'DefaultRetention': {
                'Mode': 'COMPLIANCE',
                'Years': 7
            }
        }
    }
)

Q23: How do you implement security for streaming data?

Answer:

Streaming Security Architecture:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Streaming Security Architecture                    │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Producers             Stream Processing        Consumers      │
│  ┌─────────────┐      ┌─────────────┐        ┌─────────────┐  │
│  │ Producers   │─────▶│ Kinesis     │───────▶│ Consumers   │  │
│  │ (Encrypted) │      │ (Encrypted) │        │ (Encrypted) │  │
│  └─────────────┘      └─────────────┘        └─────────────┘  │
│                                                                 │
│  Security Controls                                            │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ • KMS encryption for data at rest                       │   │
│  │ • TLS for data in transit                                │   │
│  │ • IAM policies for access control                       │   │
│  │ • VPC endpoints for private connectivity                │   │
│  └─────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘

Kinesis Encryption:

# Create encrypted KMS stream
kinesis = boto3.client('kinesis')

kinesis.create_stream(
    StreamName='secure-stream',
    ShardCount=4
)

# Enable encryption
kinesis.start_stream_encryption(
    StreamName='secure-stream',
    EncryptionType='KMS',
    KeyId='arn:aws:kms:us-east-1:123456789:key/key-id'
)

# IAM policy for secure access
iam = boto3.client('iam')

policy = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "kinesis:GetRecords",
                "kinesis:GetShardIterator",
                "kinesis:DescribeStream",
                "kinesis:ListStreams"
            ],
            "Resource": "arn:aws:kinesis:us-east-1:123456789:stream/secure-stream",
            "Condition": {
                "StringEquals": {
                    "kinesis:EncryptionType": "KMS"
                }
            }
        }
    ]
}

Q24: How do you implement security for data lakes?

Answer:

Data Lake Security Architecture:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Data Lake Security Architecture                    │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Perimeter Security       Data Security        Access Control  │
│  ┌──────────────────┐    ┌──────────────────┐ ┌──────────────┐│
│  │ WAF              │    │ Encryption       │ │ Lake Form.   ││
│  │ Shield           │    │ Classification   │ │ IAM          ││
│  │ VPC              │    │ Masking          │ │ S3 Policies  ││
│  └──────────────────┘    └──────────────────┘ └──────────────┘│
│                                                                 │
│  Monitoring            Governance            Compliance        │
│  ┌──────────────────┐ ┌──────────────────┐ ┌──────────────┐  │
│  │ CloudTrail       │ │ Data Catalog     │ │ Macie        │  │
│  │ GuardDuty        │ │ Lineage          │ │ Config       │  │
│  │ Security Hub     │ │ Quality          │ │ Audit Mgr    │  │
│  └──────────────────┘ └──────────────────┘ └──────────────┘  │
└─────────────────────────────────────────────────────────────────┘

Lake Formation Security:

# Register and secure data lake
lakeformation = boto3.client('lakeformation')

# Register location
lakeformation.register_resource(
    ResourceArn='arn:aws:s3:::data-lake-bucket',
    RoleArn='arn:aws:iam::role/LakeFormationRole'
)

# Grant database permissions
lakeformation.grant_permissions(
    Principal={'DataLakePrincipalIdentifier': 'arn:aws:iam::role/data-engineer'},
    Resource={
        'Database': {
            'Name': 'analytics_db'
        }
    },
    Permissions=['CREATE_TABLE', 'ALTER', 'DROP']
)

# Grant table permissions with conditions
lakeformation.grant_permissions(
    Principal={'DataLakePrincipalIdentifier': 'arn:aws:iam::role/analyst'},
    Resource={
        'Table': {
            'DatabaseName': 'analytics_db',
            'Name': 'sales_data'
        }
    },
    Permissions=['SELECT'],
    ConditionExpression='owner = current_principal()'
)

Q25: How do you implement a security governance framework?

Answer:

Security Governance Framework:

Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│              Security Governance Framework                      │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Policies             Standards            Procedures          │
│  ┌──────────────────┐ ┌──────────────────┐ ┌──────────────┐  │
│  │ Security Policy  │ │ Encryption Std   │ │ Incident Resp│  │
│  │ Data Policy      │ │ Access Std       │ │ Change Mgmt  │  │
│  │ Acceptable Use   │ │ Network Std      │ │ Patch Mgmt   │  │
│  └──────────────────┘ └──────────────────┘ └──────────────┘  │
│                                                                 │
│  Metrics             Reporting            Improvement         │
│  ┌──────────────────┐ ┌──────────────────┐ ┌──────────────┐  │
│  │ KPIs             │ │ Dashboards       │ │ Remediation  │  │
│  │ SLAs             │ │ Compliance Rpts  │ │ Training     │  │
│  │ Risk Scores      │ │ Audit Reports    │ │ Awareness    │  │
│  └──────────────────┘ └──────────────────┘ └──────────────┘  │
└─────────────────────────────────────────────────────────────────┘

Security Metrics Dashboard:

# Security metrics
class SecurityMetrics:
    def __init__(self):
        self.cloudwatch = boto3.client('cloudwatch')
    
    def calculate_security_score(self):
        metrics = {
            'encryption_coverage': self.get_encryption_coverage(),
            'access_control_score': self.get_access_control_score(),
            'vulnerability_score': self.get_vulnerability_score(),
            'compliance_score': self.get_compliance_score()
        }
        
        # Weighted average
        weights = {
            'encryption_coverage': 0.3,
            'access_control_score': 0.3,
            'vulnerability_score': 0.2,
            'compliance_score': 0.2
        }
        
        total_score = sum(
            metrics[k] * weights[k] for k in metrics
        )
        
        return {
            'overall_score': total_score,
            'metrics': metrics,
            'timestamp': datetime.now().isoformat()
        }
    
    def get_encryption_coverage(self):
        # Check encryption across all S3 buckets
        s3 = boto3.client('s3')
        buckets = s3.list_buckets()['Buckets']
        
        encrypted_count = 0
        for bucket in buckets:
            try:
                s3.get_bucket_encryption(Bucket=bucket['Name'])
                encrypted_count += 1
            except ClientError:
                pass
        
        return (encrypted_count / len(buckets)) * 100 if buckets else 0

Summary

Mastering AWS data security requires understanding:

Identity & Access: IAM, least privilege, MFA, SSO
Data Protection: Encryption at rest/in transit, key management
Compliance: GDPR, HIPAA, PCI DSS implementations
Monitoring: CloudTrail, GuardDuty, Security Hub
Governance: Policies, standards, procedures, metrics

These concepts form the foundation for building secure, compliant data systems on AWS.

AWS Data Security Interview Questions

🔒 AWS Data Security Interview

Security Architecture Overview

Q1: How do you implement the principle of least privilege in AWS?

Q2: How do you implement encryption at rest and in transit?

Q3: How do you implement data masking and tokenization?

Q4: How do you implement compliance frameworks (GDPR, HIPAA, PCI)?

Q5: How do you implement audit logging and monitoring?

Q6: How do you implement network security for data pipelines?

Q7: How do you implement secrets management?

Q8: How do you implement data classification?

Q9: How do you implement incident response for data breaches?

Q10: How do you implement data loss prevention (DLP)?

Q11: How do you implement zero trust architecture?

Q12: How do you implement data residency requirements?

Q13: How do you implement security monitoring and alerting?

Q14: How do you implement secure data sharing?

Q15: How do you implement security testing for data pipelines?

Q16: How do you implement API security for data services?

Q17: How do you implement compliance auditing?

Q18: How do you implement disaster recovery for security infrastructure?

Q19: How do you implement real-time threat detection?

Q20: How do you implement secure DevOps for data pipelines?

Q21: How do you implement data sovereignty?

Q22: How do you implement secure backup and recovery?

Q23: How do you implement security for streaming data?

Q24: How do you implement security for data lakes?

Q25: How do you implement a security governance framework?

Summary