Two hours later, 24 million rows with customer data were gone. Not deleted. Just… exposed. The cause? An S3 bucket full of CSVs that should have been masked. The fix? Profiles and policies that didn’t exist.
When working with data across multiple environments, it’s too easy to forget the invisible line between safe and unsafe. AWS CLI-style profiles can draw that line in code, not in memory. They act as named connections with strict permissions and environment separation. One profile might read anonymized analytics. Another might write to staging. None should see sensitive columns unless explicitly allowed.
Sensitive columns are everywhere: names, emails, payment details, health records. You don’t leave them exposed in your queries. Define what is sensitive. Tag it. Control it at the profile level. With AWS CLI-style configuration, you can store multiple profiles in ~/.aws/credentials or equivalent for other tools. Combine this with per-profile policies that hide or redact sensitive columns automatically.