Overview of Data Masking utility
developThe Data Masking utility provides tools to protect data confidentiality by performing three primary operations on sensitive information:
- Erasing: Irreversibly replaces sensitive information with a non-sensitive placeholder (default is
*****) or a custom mask. This is a one-way, in-memory operation. - Encrypting: Transforms plaintext into ciphertext using an encryption algorithm and a cryptographic key, allowing only authorized personnel to access the original data.
- Decrypting: Transforms ciphertext back into its original plaintext using the correct decryption key.
The utility integrates with the AWS Encryption SDK to follow industry and AWS security best practices, specifically utilizing Envelope Encryption (using a master key to encrypt a data key, which in turn encrypts the sensitive data).