Lab 01 — Governance & Security Kit

Phase: 14 — Security, Privacy & Governance | Difficulty: ⭐⭐⭐⭐☆ | Time: 5–6 hours

A platform serving millions must be compliant by construction. This lab builds the controls: an IAM policy evaluator (with the Deny-wins precedence everyone gets wrong), least-privilege analysis, PII column masking by clearance (Lake-Formation-style), row-level security, an audit log, and retention/deletion for GDPR.

What you build

  • iam_evaluate — explicit Deny > matching Allow > implicit Deny (wildcards via fnmatch) — the real IAM precedence
  • unused_grants — least-privilege analysis (granted but never used → remove)
  • apply_column_policy — mask each column by its PII class unless the principal's clearance covers it (column-level access control + masking)
  • row_filter / region_filter — row-level security / data residency
  • AuditLog / audited_access — every access leaves a who/what/decision trail
  • retention_expired / records_to_delete — lifecycle & erasure

Key concepts

ConceptWhat to understand
IAM precedencea targeted Deny beats any broad Allow (the classic gotcha)
Least privilegegrant only what's used; audit the gap
Column maskingPII visible only to cleared principals (P03 tags drive it)
Row-level securitya principal sees only its rows/region
Auditreconstruct who accessed what (compliance)
Retention vs deletepast retention → delete; in a lakehouse, also expire snapshots (P09)

Run

pip install -r requirements.txt
pytest test_lab.py -v
LAB_MODULE=solution pytest test_lab.py -v

Success criteria

  • All 14 tests pass — test_explicit_deny_overrides_allow and test_deny_wins_regardless_of_order certify you understand IAM precedence.
  • You can explain why PII tags belong on the schema (P03) and are enforced at the query engine (P10/Lake Formation).
  • You can explain why "DELETE the row" isn't a complete GDPR erasure on a lakehouse (P09 snapshots must expire too).

Extensions

  • Add cross-account AssumeRole evaluation (a principal in account A assuming a role in account B with a trust policy).
  • Add KMS envelope encryption modeling (data key wrapped by a CMK; a key-policy check).
  • Add tag-based access control (ABAC): grant by resource tags + principal attributes, not static ARNs.
  • Wire it to P09: a compliant erasure that deletes the row and expires the snapshots referencing it.