Masking, Redaction and Anonymization
Explore various data de-identification techniques such as masking, redaction, tokenization, and hashing to protect sensitive information in ML workflows. Understand how to use AWS Glue and DataBrew for tabular data, Amazon Comprehend for free text, and Amazon Bedrock Guardrails for prompt and response filtering. This lesson helps you implement effective data transformation strategies beyond detection to ensure secure and compliant machine learning pipelines on AWS.
The strategy table for sensitive attributes in the previous lesson included a “Transform or encode” row: apply masking, tokenization, hashing, or bucketing. This lesson shows what each of those transformations does to the data, which AWS service applies it, and how to choose between them.
Detection alone protects nothing. Amazon Macie, covered in the Data Security and Governance lesson later in this chapter, reports where sensitive data sits in Amazon S3 but does not change the objects. A separate transformation step must mask, redact, or anonymize the values before the dataset reaches training or a model prompt.
This lesson compares de-identification techniques, then treats tabular columns with AWS Glue and AWS Glue DataBrew, redacts free text with Amazon Comprehend, and filters prompts and responses with Amazon Bedrock Guardrails. The diagram below shows which service handles each kind of data.
