Reviewed by Aditya Kumar · Last reviewed 2026-03-24
Layers: (1) S3 encryption (SSE-KMS). (2) IAM + bucket policies; Lake Formation for fine-grained. (3) VPC endpoints for S3/Glue. (4) Glue Catalog permissions. (5) CloudTrail and S3 access logs. (6) Tagging, lifecycle....
Layers: (1) S3 encryption (SSE-KMS). (2) IAM + bucket policies; Lake Formation for fine-grained. (3) VPC endpoints for S3/Glue. (4) Glue Catalog permissions. (5) CloudTrail and S3 access logs. (6) Tagging, lifecycle. Best practice: Least privilege; encrypt; audit; Lake Formation for column-level.
Red Flag: Public bucket or no encryption. Pro-Move: 'SSE-KMS; Lake Formation column-level; VPC endpoints—zero public access; quarterly audit.'
According to DataEngPrep.tech, this is one of the most frequently asked Cloud/Tools interview questions, reported at 1 company. DataEngPrep.tech maintains an editor-reviewed database of 1,863 data engineering interview questions across 7 categories.