Automated Data Ingestion and Obfuscation with AWS Glue
Short answer
C Configure an AWS Glue job to read the data from the S3 bucket, detect and obfuscate sensitive data, and load the data into Amazon Redshift.
Question
Which solution will meet these requirements with the LEAST operational overhead?
Key Takeaways
The main trap is confusing Amazon Macie (a discovery tool) with a transformation/ingestion tool. Glue handles both detection and obfuscation natively in the ETL flow, reducing operational overhead compared to multi-service architectures.
This page explains how to use AWS Glue for least-overhead automated ingestion and sensitive data obfuscation from S3 to Redshift. The correct solution leverages Glue's transformation capabilities to handle both tasks in one step.
Common mistake: Choosing Option D (Redshift Dynamic Masking) is common because it keeps data static in Redshift. However, it fails the 'automatic' aspect as it requires manual policy setup and doesn't inherently detect sensitive content without pre-configured masks, leading to higher operational overhead than Glue's automated transformations.
Expert Analysis
The core requirement is to automatically ingest data from S3 to Redshift while simultaneously obfuscating sensitive data, with a mandate for least operational overhead. The key constraint is that users must not see plaintext, implying the obfuscation must occur before or during the load.
Option C is the correct choice because AWS Glue provides built-in capabilities for data transformation, including detection and masking of sensitive data (via Glue Dev Studios or predefined transformation jobs). By configuring a single Glue job to read from S3, transform (obfuscate) the data, and write to Redshift, you consolidate ingestion and security into one managed service. This minimizes operational overhead compared to orchestrating multiple services.
Option A and B involve Amazon Macie. While Macie is excellent for discovering sensitive data in S3, it is a discovery and classification tool, not an ingestion or transformation engine. Using Macie requires additional setup: running discovery jobs, integrating findings with Glue, and managing the lifecycle of these separate processes. This increases operational overhead significantly compared to doing everything within Glue. Furthermore, Macie does not automatically obfuscate data in Redshift; it flags it. You would still need another step to handle the actual obfuscation during load.
Option D suggests using Amazon Redshift’s dynamic data masking. While Redshift supports dynamic masking policies, it does not have a built-in mechanism to detect sensitive data automatically at ingestion time without prior definition of masks. Setting up and maintaining these policies requires manual intervention to define which columns are sensitive and what masking rules apply. Additionally, loading raw data first and then applying masks adds complexity. More importantly, the question asks for automatic ingestion and obfuscation. Glue’s transformation capabilities are designed specifically for this ETL pattern, making it the most streamlined solution for "least operational overhead" in an automated pipeline context.
The comment noting "Redshift has no built-in way to detect sensitive data, Glue does" aligns with this reasoning. Glue can be configured to identify patterns (like PII) and mask them as part of the ETL process, whereas Redshift relies on pre-defined masking policies which require more initial configuration and management.
Official Reference
- https://docs.aws.amazon.com/glue/latest/dg/transformations.html
- https://docs.aws.amazon.com/redshift/latest/dmg/masking-dynamic-data.html
These links open the official vendor documentation in a new tab.
Exam Strategy
When evaluating solutions for 'least operational overhead,' prioritize integrated services that perform multiple required actions (ingest + transform) over fragmented architectures. If a service like Glue can natively detect and mask data during ETL, it typically beats combining a discovery service (Macie) with a separate ETL service. Always check if the target store (Redshift) offers native automation for the specific task mentioned.
Frequently Asked Questions
Why not use Amazon Macie for automatic obfuscation?
Can Redshift automatically detect sensitive data without pre-defined masks?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Verify_Ace 👍 1 Answered CC because, Redshift has no built-in way to detect sensitive data, Glue does.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All DEA-C01 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DEA-C01 Practice Test →