🛡️ Data Compliance on AWS

Master HIPAA, GDPR, SOC2 compliance and data governance frameworks.

Module: AWS Data Engineering • Topic 35 of 65 • Premium Content

Compliance Framework

Architecture Diagram

┌─────────────────────────────────────────────────────────────────────────────┐
│                    COMPLIANCE FRAMEWORKS                                      │
│                                                                             │
│  ┌─────────────────────────────────────────────────────────────────────┐    │
│  │  HIPAA (Healthcare)                                                  │    │
│  │  • PHI encryption at rest and in transit                             │    │
│  │  • Access controls and audit trails                                  │    │
│  │  • BAA with AWS                                                      │    │
│  │  • Use HIPAA-eligible services                                       │    │
│  └─────────────────────────────────────────────────────────────────────┘    │
│                                                                             │
│  ┌─────────────────────────────────────────────────────────────────────┐    │
│  │  GDPR (EU Privacy)                                                   │    │
│  │  • Data residency in EU                                              │    │
│  │  • Right to erasure (forget)                                         │    │
│  │  • Data portability                                                  │    │
│  │  • Consent management                                                │    │
│  └─────────────────────────────────────────────────────────────────────┘    │
│                                                                             │
│  ┌─────────────────────────────────────────────────────────────────────┐    │
│  │  SOC 2                                                               │    │
│  │  • Security, Availability, Processing Integrity                    │    │
│  │  • Confidentiality, Privacy                                         │    │
│  │  • AWS compliance reports via Artifact                               │    │
│  └─────────────────────────────────────────────────────────────────────┘    │
│                                                                             │
│  ┌─────────────────────────────────────────────────────────────────────┐    │
│  │  PCI DSS (Payment Card)                                             │    │
│  │  • Cardholder data encryption                                        │    │
│  │  • Network segmentation                                              │    │
│  │  • Regular security testing                                          │    │
│  └─────────────────────────────────────────────────────────────────────┘    │
└─────────────────────────────────────────────────────────────────────────────┘

AWS Compliance Services

# Enable AWS Config for compliance monitoring
config = boto3.client('config')

# HIPAA: Check encryption
config.put_config_rule(
    ConfigRule={
        'ConfigRuleName': 'rds-encrypted',
        'Source': {
            'Owner': 'AWS',
            'SourceIdentifier': 'RDS_STORAGE_ENCRYPTED'
        }
    }
)

# GDPR: Check S3 public access
config.put_config_rule(
    ConfigRule={
        'ConfigRuleName': 's3-bucket-public-read-prohibited',
        'Source': {
            'Owner': 'AWS',
            'SourceIdentifier': 'S3_BUCKET_PUBLIC_READ_PROHIBITED'
        }
    }
)

# CloudTrail for audit
cloudtrail = boto3.client('cloudtrail')
cloudtrail.create_trail(
    Name='compliance-audit-trail',
    S3BucketName='audit-logs-bucket',
    IsMultiRegionTrail=True,
    IncludeGlobalServiceEvents=True
)
cloudtrail.start_logging(Name='compliance-audit-trail')

Interview Q&A

Q1: What are HIPAA-eligible AWS services?

Answer: S3, Redshift, RDS, EMR, Glue, Lambda, and many more. See AWS HIPAA Eligible Services Reference for the full list.

Q2: How does GDPR affect data architecture?

Answer: Requires data residency in EU, right to erasure capability, data portability, and consent tracking. Use EU regions and implement data retention policies.

Q3: What is a BAA?

Answer: Business Associate Agreement is a contract between AWS and healthcare organizations, ensuring HIPAA compliance for handling PHI.

Summary

HIPAA: PHI encryption, access controls, BAA with AWS
GDPR: EU data residency, right to erasure, consent management
SOC 2: Security controls, audit evidence, AWS Artifact reports
PCI DSS: Cardholder data encryption, network segmentation
Tools: Config rules, CloudTrail, Macie, GuardDuty