Clickstream analytics for the city portal accidentally forwards raw resident email addresses into a less-controlled OpenSearch index used by interns. What should the pipeline do?
Select an answer to reveal the explanation.
Short Explanation
Analytics sinks are often the leaky garden hose. Strip or tokenize emails before clickstream lands in the intern OpenSearch index — raw inboxes do not belong in lower-trust search.
Full Explanation
Clickstream analytics pipelines for a city portal must tokenize, hash, or omit resident email addresses before sending events to a lower-trust OpenSearch index used by interns. Sensitive fields should not flow into less-controlled analytics systems in raw form. Municipal data-handling design treats analytics sinks as leaky garden hoses unless the pipeline deliberately reduces identity before the hop. Product analytics can still count sessions and journeys without storing inbox addresses beside intern query tools.
Granting interns dynamodb:DeleteItem on the source profile table fails because broader source-table deletes increase integrity and privacy risk and do not fix analytics PII flow. Disabling OpenSearch fine-grained access control permanently fails conceptually by weakening the sink further during onboarding convenience. Duplicating full profiles into the clickstream topic for join performance fails because it maximizes PII copies in the lower-trust path.
Exam caveat: hashing emails still needs a salt/pepper strategy if the index must resist reverse lookups; omission is stronger when identity is unnecessary for the dashboard. Operational check: sample documents in the intern index after a pipeline deploy, confirm raw emails are absent or irreversibly tokenized, and review IAM so interns cannot read the authoritative profile table as a bypass.