DEA-C01 · Domain 4 of 4

DEA-C01 Domain 4: Data Security and Governance

Domain 4 covers securing and governing data pipelines on AWS: authentication with IAM and network controls, authorization through policies and Lake Formation, encryption and masking, audit logging, and privacy and data sovereignty.

Exam weight
18%
Official task statements
5
Estimated questions estimate
~9
Suggested study time estimate
10–14 hrs

About 14 min read Reviewed October 2026

Overview

Data Security and Governance has five task statements, more than any other domain. Task 4.1 covers authentication: VPC security groups, IAM roles and groups, credential rotation with AWS Secrets Manager, S3 Access Points, AWS PrivateLink, managed versus unmanaged services, and domains, domain units and projects in Amazon SageMaker Unified Studio. Task 4.2 covers authorization with custom least-privilege IAM policies, Redshift database roles, AWS Lake Formation permissions and role-, tag- and attribute-based access. Task 4.3 covers masking, anonymization and AWS KMS encryption, including across accounts and in transit.

Task 4.4 covers audit logging with AWS CloudTrail, CloudTrail Lake and CloudWatch Logs. Task 4.5 covers privacy: Redshift data sharing, PII discovery with Amazon Macie, Region restrictions, AWS Config, data sovereignty and SageMaker Catalog projects.

How it's tested

Domain 4 scenarios usually state a compliance or access requirement alongside a working pipeline: analysts may see only some columns, credentials must rotate, data must stay in one Region, or auditors need a year of API history. You choose the control that meets the requirement with the least privilege and the least custom code.

  • Fine-grained access

    Different users need different tables, columns or rows, and you choose Lake Formation permissions, LF-Tags, Redshift grants or row-level security.

  • Protect secrets and keys

    Credentials or encryption keys must be stored, rotated or shared across accounts, and you choose Secrets Manager, Parameter Store or KMS key policies.

  • Prove compliance

    An auditor or regulator asks for evidence, PII discovery or Region limits, and you pick CloudTrail Lake, AWS Config, Macie or service control policies.

Reasoning it through

A data lake in S3 is queried through Athena by finance and marketing analysts. Marketing must not see the customer_tax_id column. Bucket policies cannot hide one column inside a Parquet file, and separate copies of the table add cost and drift. Registering the location with Lake Formation and granting marketing column-level SELECT that excludes that column enforces the rule for Athena, Redshift Spectrum and EMR from one place.

Task statements 5

Official task statements from the Amazon Web Services outline, in outline order.

4.1 Apply authentication mechanismsSecurity groups, IAM identities, credential rotation, endpoints and SageMaker Unified Studio domains.
What it means
This task statement covers updating VPC security groups, creating and updating IAM groups, roles, endpoints and services, rotating credentials with AWS Secrets Manager, setting up IAM roles for Lambda, Amazon API Gateway, the AWS CLI and AWS CloudFormation, applying IAM policies to S3 Access Points and AWS PrivateLink endpoints, describing managed versus unmanaged services, and using domains, domain units and projects in Amazon SageMaker Unified Studio.
What to understand
Services authenticate with IAM roles, not stored access keys: a Glue job or Lambda function assumes its execution role and receives temporary credentials. Security groups are stateful and control which ports and sources reach resources such as a Redshift cluster or an RDS database used by a Glue connection. Secrets Manager rotates database passwords automatically through a rotation function. VPC endpoints keep traffic to S3 and other services on the AWS network, and endpoint policies limit which buckets they reach. In a managed service AWS patches the platform; with self-managed software on EC2, you do.
How it shows up
A service or user needs to connect securely, and you choose the role, network rule, endpoint or credential approach.
Common confusion
Embedding long-term IAM access keys in a job script instead of using the service's execution role.
4.2 Apply authorization mechanismsCustom least-privilege policies, credential storage, database grants, Lake Formation and RBAC, TBAC and ABAC.
What it means
This task statement covers writing custom IAM policies when managed policies fall short, storing application and database credentials in Secrets Manager or AWS Systems Manager Parameter Store, granting users, groups and roles access inside databases such as Amazon Redshift, managing permissions through AWS Lake Formation for Redshift, Amazon EMR, Athena and Amazon S3, applying role-based, tag-based and attribute-based authorization, and building policies that follow least privilege.
What to understand
IAM decides whether a principal can call an AWS API; database grants decide what a user can do inside Redshift. Lake Formation centralizes database, table, column, row and cell-level permissions for catalog data and supports LF-Tags, which scale permissions through tags instead of per-table grants. ABAC in IAM compares principal tags with resource tags, so new projects need no new policies. Secrets Manager adds rotation and cross-account sharing; Parameter Store SecureString is a cheaper option without built-in rotation. Least privilege means named actions on named resources, with conditions where possible.
How it shows up
A team needs specific data access, and you pick the authorization layer and model with the narrowest grant.
Common confusion
Using S3 bucket policies to restrict columns; only Lake Formation or the query engine can enforce column-level access.
4.3 Ensure data encryption and maskingMasking and anonymization, AWS KMS, cross-account encryption and encryption in transit.
What it means
This task statement covers applying data masking and anonymization according to compliance rules or company policy, using AWS KMS keys to encrypt and decrypt data, configuring encryption across AWS account boundaries, and enabling encryption in transit or before transit.
What to understand
SSE-S3 uses S3-managed keys; SSE-KMS adds key policies, CloudTrail records of key use and rotation control; client-side encryption protects data before transit. Cross-account reads of SSE-KMS objects need both the bucket policy and the KMS key policy to allow the other account's role. TLS protects data in transit, and a bucket policy that denies requests where aws:SecureTransport is false enforces it. Redshift dynamic data masking hides values at query time by role. Anonymization techniques include tokenization, hashing and generalization, and DataBrew offers masking transforms for PII columns.
How it shows up
A compliance rule on keys, sharing or exposure of values is given, and you choose the encryption option or masking method.
Common confusion
Granting cross-account bucket access but forgetting the KMS key policy, so reads fail with access denied.
4.4 Prepare logs for auditCloudTrail, CloudWatch Logs, CloudTrail Lake, log analysis and large-volume logging.
What it means
This task statement covers tracking API calls with AWS CloudTrail, storing application logs in Amazon CloudWatch Logs, querying centralized logs in AWS CloudTrail Lake, analyzing logs with Athena, CloudWatch Logs Insights and Amazon OpenSearch Service, and integrating services such as Amazon EMR to process large log volumes.
What to understand
CloudTrail management events record control-plane calls by default; S3 object-level and Lambda invoke activity require data events, which cost extra. A trail delivers log files to S3 for long retention, and an organization trail covers every account. CloudTrail Lake keeps events in managed event data stores that you query with SQL, removing the need to build Athena tables. CloudWatch Logs retention settings, exports and subscription filters move logs to S3 or OpenSearch Service. Log file integrity validation proves CloudTrail files were not altered.
How it shows up
An auditor needs specific activity history, and you pick the event type, store, retention approach or query tool.
Common confusion
Assuming CloudTrail captures S3 GetObject calls by default; object-level access needs data events enabled.
4.5 Understand data privacy and governanceData sharing, PII discovery, Region controls, AWS Config, sovereignty and SageMaker Catalog projects.
What it means
This task statement covers granting permissions for data sharing such as Amazon Redshift data sharing, identifying PII with Amazon Macie alongside Lake Formation, preventing backups or replication to disallowed AWS Regions, viewing configuration changes with AWS Config, maintaining data sovereignty, managing access through Amazon SageMaker Catalog projects, and describing governance frameworks and data sharing patterns.
What to understand
Redshift data sharing gives live, read-only access to other clusters, serverless workgroups or accounts without copying data. Macie scans S3 for PII and reports findings that can feed tagging and Lake Formation restrictions. Service control policies with an aws:RequestedRegion condition block actions in unapproved Regions, and replication and backup rules must target only allowed Regions. AWS Config records resource configuration history and evaluates rules. SageMaker Catalog projects let consumers subscribe to published data assets with owner approval, which matches a data mesh sharing pattern.
How it shows up
A privacy, residency or sharing requirement is described, and you choose the AWS feature that enforces or proves it.
Common confusion
Using CloudTrail to see a resource's past settings; AWS Config records configuration state over time.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • IAM roles for services

    Temporary credentials assumed by Glue, Lambda, EMR and Redshift.

    Remember
    Never embed access keys.
    Tested as
    Authentication questions.
    Trap
    Creating IAM users for pipelines.

  • Secrets Manager vs. Parameter Store

    Managed secrets with rotation versus a parameter store with SecureString values.

    Remember
    Required rotation means Secrets Manager.
    Tested as
    Credential questions.
    Trap
    Hardcoding passwords in job parameters.

  • Lake Formation permissions

    Central grants on databases, tables, columns, rows and cells.

    Remember
    Enforced for Athena, Redshift Spectrum, EMR and Glue.
    Tested as
    Fine-grained access questions.
    Trap
    Relying on bucket policies alone.

  • LF-Tags

    Tag-based access control in Lake Formation.

    Remember
    Scales grants across many tables.
    Tested as
    TBAC questions.
    Trap
    Granting table by table as the lake grows.

  • ABAC

    Policies that match principal tags to resource tags.

    Remember
    Fewer policies as teams grow.
    Tested as
    Authorization model questions.
    Trap
    Confusing it with role-based access.

  • SSE-KMS

    Server-side encryption with KMS keys and key policies.

    Remember
    Key use is logged in CloudTrail.
    Tested as
    Encryption questions.
    Trap
    Choosing SSE-S3 when key control or audit is required.

  • Cross-account KMS access

    Key policy and IAM policy must both allow the other account.

    Remember
    Two layers of permission.
    Tested as
    Sharing questions.
    Trap
    Updating only the bucket policy.

  • Redshift dynamic data masking

    Policies that mask column values at query time by role.

    Remember
    Stored data stays unchanged.
    Tested as
    Masking questions.
    Trap
    Creating masked copies of tables.

  • CloudTrail data events

    Object-level and function-level API records.

    Remember
    Not enabled by default.
    Tested as
    Audit questions.
    Trap
    Expecting GetObject records without enabling them.

  • CloudTrail Lake

    Managed event data store queried with SQL.

    Remember
    Centralized, long-term audit queries.
    Tested as
    Log questions.
    Trap
    Building Athena tables when CloudTrail Lake fits.

  • Amazon Macie

    Discovers sensitive data such as PII in S3.

    Remember
    Findings drive classification and access rules.
    Tested as
    Privacy questions.
    Trap
    Expecting Macie to block access by itself.

  • Redshift data sharing

    Live, read-only sharing across clusters and accounts.

    Remember
    No data copies.
    Tested as
    Sharing questions.
    Trap
    Using UNLOAD and COPY to share.

  • AWS Config

    Configuration history and compliance rules for resources.

    Remember
    Shows what a setting was at a point in time.
    Tested as
    Governance questions.
    Trap
    Using CloudTrail as a configuration history.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Access control layers

ConceptMeaningKey differenceCommon trap
IAM policies Allow or deny AWS API actions Identity and resource level Expecting column-level control
S3 bucket policies Resource policy on a bucket Whole objects and prefixes Using them to hide columns
AWS Lake Formation Catalog-based data permissions Table, column, row and cell grants Forgetting to register the S3 location
Redshift grants and roles Permissions inside the database Schemas, tables and views Assuming IAM alone controls SQL access

S3 encryption options

ConceptMeaningKey differenceCommon trap
SSE-S3 S3-managed keys No key policy to manage Choosing it when key audit is required
SSE-KMS KMS keys with key policies Control and logged key use Forgetting key policy for other accounts
Client-side encryption Data encrypted before upload AWS never sees plaintext Choosing it when server-side meets the need

Audit and governance services

ConceptMeaningKey differenceCommon trap
AWS CloudTrail API activity records Who called what Using it for configuration snapshots
CloudTrail Lake SQL-queryable event store Centralized investigations Assuming a trail is required to query
AWS Config Configuration history and rules State of resources over time Using it to find API callers
Amazon Macie Sensitive data discovery in S3 Finds PII, does not block Expecting it to enforce access

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Bucket policy for columns

    What candidates pick
    Use an S3 bucket policy so analysts cannot read the PII column.
    Why it looks right
    Bucket policies control S3 access.
    Why it's wrong
    Bucket policies act on whole objects; column-level restriction requires Lake Formation data filters or engine-level controls.

    Clue to watch for Access differs by column or row in the same table.

  2. Manual rotation in Parameter Store

    What candidates pick
    Store the Redshift password as a SecureString and rotate it by hand.
    Why it looks right
    Parameter Store costs less.
    Why it's wrong
    Secrets Manager rotates database credentials automatically on a schedule, which a manual process cannot match for compliance.

    Clue to watch for Credentials must rotate automatically.

  3. Bucket policy only for cross-account reads

    What candidates pick
    Add the partner account to the bucket policy for SSE-KMS objects.
    Why it looks right
    That is how cross-account S3 access usually works.
    Why it's wrong
    Decryption also needs kms:Decrypt in the key policy; without it the read fails even though S3 allows the request.

    Clue to watch for Objects use a customer managed KMS key.

  4. CloudTrail for configuration history

    What candidates pick
    Search CloudTrail to show auditors a bucket's encryption setting six months ago.
    Why it looks right
    CloudTrail logs changes.
    Why it's wrong
    AWS Config records configuration snapshots and timelines, showing the resource's actual state at a point in time.

    Clue to watch for The question asks what a setting was, not who called an API.

  5. Copies for sharing

    What candidates pick
    UNLOAD tables to S3 and COPY them into the partner cluster weekly.
    Why it looks right
    Familiar commands.
    Why it's wrong
    Redshift data sharing provides live, read-only access without copies, so consumers always see current data with no pipeline to maintain.

    Clue to watch for Another cluster or account needs current data.

  6. Macie as enforcement

    What candidates pick
    Enable Amazon Macie to block access to files with PII.
    Why it looks right
    Macie is the PII service.
    Why it's wrong
    Macie discovers and reports sensitive data; blocking access requires IAM, bucket policies or Lake Formation rules acting on its findings.

    Clue to watch for The requirement is to both find and restrict sensitive data.

  7. Region limits by convention

    What candidates pick
    Ask teams not to replicate backups to other Regions.
    Why it looks right
    Simple and quick.
    Why it's wrong
    An organization service control policy that denies actions in unapproved Regions, plus reviewed replication and backup rules, enforces residency instead of relying on people.

    Clue to watch for Data must never leave approved Regions.

Answer framework

Follow these steps for Domain 4 questions about who can reach data, how it is protected, and how compliance is proven.

  1. Identify the identity: services should use IAM roles with temporary credentials, and people should come through federation, never shared access keys.
  2. Pick the authorization layer that matches the grain: IAM for AWS APIs, Lake Formation for tables, columns and rows, and database grants inside Redshift.
  3. Store secrets in Secrets Manager when rotation is required, and encrypt data with KMS keys whose policies cover every account that must decrypt.
  4. Choose masking or anonymization when users need the data shape but not the values, using Redshift dynamic masking, Lake Formation filters or DataBrew transforms.
  5. Prove compliance with CloudTrail data events, CloudTrail Lake queries, AWS Config history, Macie findings and Region-limiting service control policies.

Practice question

A data engineer must let a partner AWS account query Parquet files in an S3 bucket. The objects are encrypted with a customer managed AWS KMS key. The bucket policy already grants the partner's IAM role read access, but queries fail with access denied errors. What should the engineer change?

Want more like this? The DEA-C01 practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Organize this domain by layer rather than by service. On one page, draw the network layer (security groups, VPC endpoints, PrivateLink), the identity layer (IAM roles, federation, SageMaker Unified Studio domains), the data access layer (Lake Formation, Redshift grants, masking), the key layer (KMS key and bucket policies) and the evidence layer (CloudTrail, CloudTrail Lake, Config, Macie). Most exam scenarios fail at exactly one layer, and naming it quickly narrows the options.

Then practice in a sandbox. Register an S3 location in Lake Formation, create an LF-Tag, and grant column-level access to one role while another sees everything. Encrypt a bucket with a customer managed KMS key and reproduce the cross-account access denied error before fixing the key policy. Rotate a secret in Secrets Manager and watch the rotation function update an RDS password.

Finish by reading the IAM policy evaluation logic once, especially explicit deny, SCPs and resource policies. During practice questions, reject any option that uses long-term keys, wildcards on actions, or copies data just to restrict access.

FAQ

How much of DEA-C01 is Domain 4?

Data Security and Governance is 18% of scored content, about 9 of the 50 scored questions. It has five task statements, the most of any domain.

When should I use Lake Formation instead of IAM?

Use IAM for access to AWS APIs and whole S3 locations. Use Lake Formation when access depends on databases, tables, columns, rows or tags in the Data Catalog.

Do I need to know SageMaker Unified Studio for security questions?

Yes, at a concept level. Task 4.1 names domains, domain units and projects, and Task 4.5 names SageMaker Catalog projects for managing data access.

Is Secrets Manager always better than Parameter Store?

No. Secrets Manager adds automatic rotation and cross-account sharing at a cost. Parameter Store SecureString suits configuration values and secrets that do not need managed rotation.

What is the difference between CloudTrail and CloudTrail Lake?

A CloudTrail trail delivers event files to S3. CloudTrail Lake stores events in a managed event data store you query directly with SQL for centralized investigations.

How do I keep data inside one Region?

Use service control policies that deny actions in unapproved Regions, configure replication and backups only to allowed Regions, and monitor with AWS Config rules.

Does Macie restrict access to sensitive data?

No. Macie discovers and classifies sensitive data in S3. You act on its findings with tags, Lake Formation permissions, bucket policies or masking.

Other Data & Analytics certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

You have reviewed authentication, authorization, encryption, audit logging and privacy controls. Test whether you can spot the one missing permission or control in a security scenario.

Take the DEA-C01 practice test Check your DEA-C01 readiness

Keep going