A public-health department needs to redact PII such as Social Security numbers and home addresses from patient intake records before those records are used for feature engineering in a health-outcomes model. Which AWS Glue capability is designed for this redaction step?
Select an answer to reveal the explanation.
Short Explanation
Think of DataBrew like a redaction marker you'd use on a paper document — you go field by field and black out the Social Security number or the address before anyone downstream ever sees it. That's a data-masking transformation, built specifically to obscure or remove sensitive values as part of a visual prep recipe. Crawlers just catalog what's there, quality rules just check it, and catalog versioning just tracks changes — none of those actually redact anything.
Full Explanation
Glue DataBrew provides built-in transformations, including masking and PII-redaction steps, that can be applied within a visual data-preparation recipe to obscure, hash, or remove sensitive fields like Social Security numbers and addresses before the resulting dataset moves on to feature engineering — this is the tool purpose-built for exactly this redaction task. Glue crawlers infer and catalog schema metadata; they identify that a column exists and its inferred type, but they don't recognize sensitive content semantically or take any action to mask it. Glue Data Quality rules validate whether data meets defined quality expectations (completeness, format, ranges) and can flag or quarantine records that fail them, but a quality rule checks data, it doesn't transform or redact it. Data Catalog versioning tracks changes to table schema definitions over time so past versions can be reviewed or restored, which is a metadata-governance feature entirely separate from field-level content redaction, and it does nothing to prevent or reverse an actual PII exposure in the data itself. Scope note: redaction rules should be validated against real sample records, since automated PII detection can miss non-standard formats, such as an address embedded in a free-text note field. Operational check: after running the DataBrew recipe, manually inspect a sample of output records to confirm no SSNs or addresses remain in plain text before the data reaches feature engineering.