Case Study
At a glance
The data landscape
Profile
Publicly traded neobank
Regulated identifiers held for every customer
Accounts held through partner banks
Environment
Snowflake, more than 5 PB
AWS
Jira
Amazon S3 data lake on Iceberg (next)
The challenge
Regulated identifiers in a warehouse that kept growing
A warehouse that grew fast. The Snowflake warehouse went from about 2 PB to more than 5 PB in three years. Every new table was another place a Social Security, bank account, driver's license or passport number could land.
Account numbers with no single format. Each banking partner formats account numbers its own way, so generic detection patterns missed them.
Alerts that stopped at the table. When a rule fired, the alert named a table. Finding the column meant a manual search across five petabytes.
“For me there's no other way of knowing … whether we have any bank account numbers in Snowflake or not.”
The bank's Staff Data Security Engineer
Why Bedrock Data
Detection built around the bank's own data
In-environment scanning
A serverless Bedrock Data Outpost runs in the bank's own AWS account, managed with Terraform. The data stays in its environment.
Detection tuned to partner formats
Bank account detection was rebuilt around the formats the bank's partners use, with validation rules on top.
The bank's own tiers
Five high-confidence policies sort every match into the bank's restricted, confidential and public tiers.
Column-level findings
Each finding names the column that holds the identifier, so the team starts from the answer.
Findings in the on-call workflow
Findings open Jira tickets in the workflow on-call already runs.
Continuous coverage
Daily scans, with a full pass across the warehouse every month.
Results
Column-level answers across 5 PB
More than 5 PB classified every day. Daily scans and a monthly full pass keep the warehouse current against the bank's own tiers.
Detection rebuilt in under a week. The new bank account detection was written and the warehouse rescanned inside a week.
Noise the team can tune. The first custom rule raised 150 alerts, and tuning brought the false positives down from there.
Findings precise enough to automate. Column-level findings are specific enough for the team to build automation on.
Every finding names the column and lands in the workflow the team already uses, so the security team can show where each regulated identifier sits and act on it without a manual search.
The vision
Knowing, every day, where each identifier sits
“We had no reliable way of knowing whether bank account numbers were sitting in Snowflake. With Bedrock Data, we know every day, down to the column, across more than five petabytes.”
The bank's Staff Data Security Engineer
What's next
Where this is heading
The bank's S3 data lake on Iceberg tables is the next workload in line, with the same tiers and the same workflow.
