# SecureCart Journey

Securing data is **critical for protecting customer transactions, payment information, and order details** in SecureCart. Task Statement 1.3 focuses on implementing **appropriate data security controls** to ensure **data governance, encryption, access control, and lifecycle management**.

✔ **Why does SecureCart prioritize data security?**

* **Protects sensitive customer data** (names, addresses, payment info).
* **Ensures compliance with regulations** (PCI DSS, GDPR).
* **Prevents data loss and unauthorized access**.
* **Maintains data integrity and availability**.

***

### **🔹 Step 1: Understanding SecureCart’s Data Security Requirements**

**Who Needs Access to Data?**

| **Role**                         | **Access Level**   | **Data Type**                   |
| -------------------------------- | ------------------ | ------------------------------- |
| **Developers**                   | Read-only access   | Logs, application data.         |
| **Security Team**                | Full visibility    | Security logs, IAM policies.    |
| **Database Administrators**      | Read/Write         | RDS & DynamoDB databases.       |
| **Application Services**         | Controlled access  | Order history, product catalog. |
| **Third-Party Payment Provider** | Limited API access | Transaction details.            |

**What Data Needs to Be Protected?**

| **Data Type**           | **Storage Location**      | **Protection Method**                    |
| ----------------------- | ------------------------- | ---------------------------------------- |
| **Customer Data (PII)** | Amazon RDS, DynamoDB      | Encryption at rest & access control.     |
| **Order Transactions**  | DynamoDB                  | IAM Role-based access policies.          |
| **Logs & Audit Data**   | Amazon S3                 | S3 bucket policies & retention policies. |
| **Payment Information** | External Payment Provider | Tokenization & PCI compliance.           |

✅ **Best Practices:**\
✔ Apply **role-based access control (RBAC)** to prevent unauthorized access.\
✔ Encrypt **all sensitive data at rest and in transit**.\
✔ Implement **data retention policies** to remove stale data.

***

### **🔹 Step 2: Implementing Data Encryption at Rest & In Transit**

#### **A. Encrypting Data at Rest**

✔ **Why?** – Prevents unauthorized access if storage media is compromised.\
✔ **How SecureCart Encrypts Data at Rest:**

| **Service**         | **Encryption Method** | **Use Case in SecureCart**                        |
| ------------------- | --------------------- | ------------------------------------------------- |
| **Amazon RDS**      | AWS KMS Encryption    | Protects customer order data in MySQL/PostgreSQL. |
| **Amazon DynamoDB** | AES-256 Encryption    | Encrypts transactional order records.             |
| **Amazon S3**       | S3 Default Encryption | Protects stored invoices, logs, and backups.      |
| **Amazon EBS**      | Volume Encryption     | Encrypts attached storage for EC2 instances.      |

✅ **Best Practices:**\
✔ Use **AWS Key Management Service (KMS) for centralized key management**.\
✔ Enable **S3 bucket default encryption** to avoid accidental unencrypted uploads.\
✔ Regularly **rotate encryption keys** for enhanced security.

***

#### **B. Encrypting Data in Transit**

✔ **Why?** – Prevents **eavesdropping and man-in-the-middle (MitM) attacks**.\
✔ **How SecureCart Ensures Secure Data Transfers:**

| **Encryption Type**               | **Use Case in SecureCart**                                     |
| --------------------------------- | -------------------------------------------------------------- |
| **TLS 1.2+ (HTTPS)**              | Encrypts API calls between the frontend & backend.             |
| **AWS Certificate Manager (ACM)** | Manages SSL certificates for ALB & API Gateway.                |
| **IPsec VPN**                     | Secure communication between AWS and on-premises data centers. |
| **AWS PrivateLink**               | Private access to AWS services (e.g., S3, DynamoDB).           |

✅ **Best Practices:**\
✔ Enforce **TLS 1.2 or later** for all network communications.\
✔ Use **AWS PrivateLink instead of exposing API endpoints publicly**.\
✔ Regularly **renew SSL/TLS certificates** via ACM.

***

### **🔹 Step 3: Implementing Access Policies for Data Security**

✔ **Why?** – Prevents **unauthorized access** and **enforces the principle of least privilege**.\
✔ **How SecureCart Restricts Data Access:**

#### **A. IAM & Resource Policies for Data Access Control**

| **Policy Type**       | **Applies To**       | **Use Case**                                                   |
| --------------------- | -------------------- | -------------------------------------------------------------- |
| **IAM Policies**      | IAM Roles, Users     | Developers get read-only access to logs.                       |
| **Resource Policies** | S3, DynamoDB, RDS    | S3 bucket allows access **only from SecureCart applications**. |
| **VPC Endpoints**     | Private AWS Services | DynamoDB access restricted **to VPC only**.                    |

✅ **Best Practices:**\
✔ **Deny all access by default**, then allow only what is needed.\
✔ Use **IAM roles instead of static credentials** for applications.\
✔ **Enable IAM Access Analyzer** to detect overly permissive policies.

***

### **🔹 Step 4: Implementing Data Backups & Recovery**

✔ **Why?** – Ensures **business continuity and disaster recovery (DR)**.\
✔ **How SecureCart Implements Data Backups:**

| **Data Type**     | **Backup Method**         | **Retention Policy**                             |
| ----------------- | ------------------------- | ------------------------------------------------ |
| **RDS Databases** | Automatic Snapshots       | 7-day retention, point-in-time recovery enabled. |
| **DynamoDB**      | Continuous Backups (PITR) | Restores deleted/missing records.                |
| **S3 Logs**       | Versioning & Replication  | Archived in Glacier for 90 days.                 |

✅ **Best Practices:**\
✔ Enable **Amazon RDS Automated Backups** for point-in-time recovery.\
✔ Use **S3 Lifecycle Policies** to automatically transition old backups to Glacier.\
✔ Regularly **test backup restoration procedures**.

***

### **🔹 Step 5: Implementing Data Retention & Lifecycle Management**

✔ **Why?** – Reduces **storage costs and ensures compliance**.\
✔ **How SecureCart Manages Data Lifecycles:**

| **Data Type**     | **Lifecycle Policy**  | **Storage Class**                 |
| ----------------- | --------------------- | --------------------------------- |
| **Order Logs**    | Archive after 30 days | Amazon S3 Glacier.                |
| **Customer Data** | Delete after 5 years  | Amazon RDS with backup retention. |
| **Security Logs** | Retain for 1 year     | Amazon S3 Standard-IA.            |

✅ **Best Practices:**\
✔ Define **clear data retention policies** for compliance.\
✔ Use **S3 Lifecycle Rules** to automatically transition data to cheaper storage.\
✔ Implement **data classification** for sensitive data.

***

### **🔹 Step 6: Monitoring & Auditing Data Security**

✔ **Why?** – Detects **unauthorized access & data breaches** in real-time.\
✔ **How SecureCart Monitors Data Security:**

| **Monitoring Tool**  | **Purpose**                     | **Use Case in SecureCart**            |
| -------------------- | ------------------------------- | ------------------------------------- |
| **AWS CloudTrail**   | Logs all AWS API calls          | Detects unauthorized database access. |
| **Amazon Macie**     | Scans S3 for sensitive data     | Identifies exposed customer data.     |
| **Amazon GuardDuty** | Monitors threats                | Detects suspicious API calls.         |
| **AWS Security Hub** | Centralized security monitoring | Aggregates security findings.         |

✅ **Best Practices:**\
✔ **Enable CloudTrail logging** across all AWS accounts.\
✔ Use **Macie to classify and detect sensitive data in S3**.\
✔ Regularly **review IAM activity logs for anomalies**.

***

## **🚀 Summary**

✔ **Encrypt all data at rest and in transit** using KMS and TLS.\
✔ **Implement IAM & Resource Policies** to enforce access control.\
✔ **Use automated backups and disaster recovery plans** to protect data.\
✔ **Apply S3 Lifecycle Policies to manage data retention and cost.**\
✔ **Monitor security logs with CloudTrail, GuardDuty, and Macie.**


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://awsinpractice.itassist.com/study-group/aws-certified-solutions-architect-associate/domain-1-design-secure-architectures/task-statement-1.3-determine-appropriate-data-security-controls/securecart-journey.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.