# Managing Data Lifecycle & Protection Policies

Managing data lifecycle and protection policies is essential to **SecureCart’s data governance strategy**. AWS provides tools to **automate data retention, enforce security policies, optimize costs, and ensure compliance** with regulatory requirements.

✔ **Why does SecureCart focus on Data Lifecycle & Protection?**

* **Ensures that data is stored securely and for the appropriate duration.**
* **Prevents data loss and unauthorized access.**
* **Optimizes storage costs by moving data to lower-cost tiers.**
* **Maintains compliance with GDPR, PCI DSS, and HIPAA regulations.**

***

### **🔹 Step 1: Understanding Data Lifecycle Management**

✔ **What is Data Lifecycle Management?** – It **defines the process of storing, managing, and deleting data** over time based on business and compliance needs.

#### **A. Key Phases of Data Lifecycle Management**

| **Phase**     | **Description**                                                 | **SecureCart Use Case**                                                |
| ------------- | --------------------------------------------------------------- | ---------------------------------------------------------------------- |
| **Creation**  | Data is generated and ingested into AWS.                        | Customers place orders that get stored in **Amazon RDS and DynamoDB**. |
| **Usage**     | Data is actively used by applications and services.             | SecureCart **retrieves order history for customers**.                  |
| **Retention** | Data is kept for a specific period based on compliance needs.   | SecureCart **retains customer invoices for 7 years**.                  |
| **Archival**  | Data is moved to lower-cost storage tiers when rarely accessed. | SecureCart **archives old logs to Amazon S3 Glacier**.                 |
| **Deletion**  | Data is securely deleted when no longer needed.                 | SecureCart **removes expired session data from DynamoDB**.             |

✅ **Best Practices:**\
✔ **Define retention policies** for different data types.\
✔ **Use automated lifecycle policies** to transition data to cost-effective storage tiers.\
✔ **Implement secure deletion processes** to prevent data exposure.

***

### **🔹 Step 2: Automating Data Lifecycle with AWS Services**

✔ **Why?** – Automating lifecycle management reduces **manual overhead, enforces policies, and optimizes storage costs**.

| **AWS Service**     | **Lifecycle Feature**      | **Use Case in SecureCart**                        |
| ------------------- | -------------------------- | ------------------------------------------------- |
| **Amazon S3**       | Lifecycle Policies         | Moves customer invoices to Glacier after 1 year.  |
| **Amazon RDS**      | Backup Retention           | Retains database snapshots for 7 days.            |
| **Amazon DynamoDB** | Time-to-Live (TTL)         | Deletes expired session data after 30 days.       |
| **Amazon EBS**      | Snapshot Lifecycle Manager | Automates snapshot retention for backend servers. |

✅ **Best Practices:**\
✔ Use **Amazon S3 Lifecycle Policies** to transition data automatically.\
✔ Implement **DynamoDB TTL to delete old session data** without manual intervention.\
✔ Configure **EBS Snapshot Lifecycle Policies** to automate backup expiration.

***

### **🔹 Step 3: Implementing Data Protection Policies**

✔ **Why?** – Protection policies ensure that data remains **secure, compliant, and recoverable**.

#### **A. IAM & Resource-Based Access Controls**

| **Policy Type**                     | **Use Case**                                                 |
| ----------------------------------- | ------------------------------------------------------------ |
| **IAM Policies**                    | Restricts developer access to **customer order data**.       |
| **Resource Policies**               | Prevents **unauthorized access to S3 buckets**.              |
| **Service Control Policies (SCPs)** | Blocks deletion of **security logs in production accounts**. |

#### **B. Data Encryption Policies**

✔ **Why?** – Ensures that all sensitive data is encrypted **at rest and in transit**.

| **AWS Encryption Method**            | **Use Case in SecureCart**                           |
| ------------------------------------ | ---------------------------------------------------- |
| **AWS KMS (Key Management Service)** | Encrypts **RDS databases and S3 buckets**.           |
| **S3 Default Encryption**            | Ensures **all uploads are automatically encrypted**. |
| **TLS Encryption (ACM)**             | Protects **API and frontend communication**.         |

✅ **Best Practices:**\
✔ **Apply IAM permissions carefully** to prevent unauthorized data access.\
✔ **Enable default encryption** on all storage services.\
✔ **Rotate encryption keys periodically** using AWS KMS.

***

### **🔹 Step 4: Data Retention & Compliance Enforcement**

✔ **Why?** – Compliance regulations require SecureCart to **retain data for a set period and enforce security policies**.

| **Compliance Standard** | **Retention Requirement**                        | **AWS Service Used**           |
| ----------------------- | ------------------------------------------------ | ------------------------------ |
| **PCI DSS**             | Retain payment data for **up to 5 years**.       | Amazon RDS, S3 Lifecycle.      |
| **GDPR**                | Delete customer data upon request.               | AWS Data Lifecycle Management. |
| **HIPAA**               | Encrypt patient data and retain for **7 years**. | AWS KMS, IAM Policies.         |

✅ **Best Practices:**\
✔ Define **retention policies** that align with regulatory requirements.\
✔ Implement **data deletion policies for GDPR compliance**.\
✔ Use **AWS Config and Security Hub** to detect non-compliance.

***

### **🔹 Step 5: Securing Data Deletion & Archival**

✔ **Why?** – Proper data deletion ensures **compliance and prevents data exposure**.

| **Deletion Method**             | **Use Case in SecureCart**                                 |
| ------------------------------- | ---------------------------------------------------------- |
| **Amazon S3 Object Expiration** | Deletes old invoices **automatically after 7 years**.      |
| **DynamoDB TTL**                | Removes expired session data **after 30 days**.            |
| **KMS Key Deletion**            | Ensures **permanent removal of archived encryption keys**. |

✅ **Best Practices:**\
✔ Configure **S3 Object Expiration to remove stale data automatically**.\
✔ Use **DynamoDB TTL to auto-delete session-based records**.\
✔ Implement **IAM restrictions on data deletions** to prevent accidental loss.

***

### **🔹 Step 6: Monitoring & Auditing Data Lifecycle Policies**

✔ **Why?** – Continuous monitoring ensures SecureCart’s **data lifecycle policies are followed and enforced**.

| **AWS Service**      | **Purpose**                         | **Use Case in SecureCart**                                   |
| -------------------- | ----------------------------------- | ------------------------------------------------------------ |
| **AWS CloudTrail**   | Logs all API actions.               | Detects unauthorized changes to **data retention settings**. |
| **AWS Config**       | Monitors policy compliance.         | Ensures **S3 buckets have lifecycle policies enabled**.      |
| **Amazon Macie**     | Identifies sensitive data exposure. | Finds **unencrypted customer data in S3**.                   |
| **AWS Security Hub** | Centralizes security monitoring.    | Tracks **violations of compliance rules**.                   |

✅ **Best Practices:**\
✔ **Enable CloudTrail to track all API and data access actions**.\
✔ **Use AWS Config to automatically enforce compliance rules**.\
✔ **Monitor sensitive data with Amazon Macie**.

***

## **🚀 Summary**

✔ **Implement S3 Lifecycle, RDS backup retention, and DynamoDB TTL for automated data lifecycle management.**\
✔ **Apply IAM & Resource Policies to control data access and encryption policies for data protection.**\
✔ **Ensure compliance with GDPR, PCI DSS, and HIPAA using AWS Config and Security Hub.**\
✔ **Use S3 Object Expiration, KMS Key Deletion, and DynamoDB TTL for secure data deletion.**\
✔ **Monitor and audit data lifecycle policies with AWS CloudTrail, Config, and Macie.**

#### **Scenario:**

SecureCart must implement **efficient data lifecycle policies** to optimize **cost and security** while ensuring **long-term data protection**.

#### **Key Learning Objectives:**

✅ Implement **S3 Lifecycle Rules for Cost Optimization**\
✅ Use **Amazon Glacier for Long-Term Data Archival**\
✅ Apply **IAM Conditions to Enforce Data Access Policies**\
✅ Automate **data lifecycle transitions** using AWS services

#### **Hands-on Labs:**

1️⃣ **Set Up S3 Lifecycle Rules to Transition Data to Glacier**\
2️⃣ **Apply IAM Conditions to Control Access to Old Data**\
3️⃣ **Configure AWS Backup Lifecycle Policies**

🔹 **Outcome:** SecureCart **optimizes data storage while maintaining compliance and security**.