Encryption at rest protects stored data files by encoding them so they cannot be read without the required cryptographic key. It forms part of a broader storage security design alongside access control, auditability, and compliant data placement. section 5.1.2
Apply encryption at rest across the lakehouse’s persistent layers:
- Enable server-side encryption for storage data, using provider-managed keys or BYOK/KMS integration when compliance requires greater lifecycle control. section 5.1.2
- Protect catalog metadata as well as data files, including snapshot history, partition values, schema records, and persisted catalog state. section 7.2.3
- Pair encryption with identity controls, access logging, key-management records, and residency policies; encryption alone does not govern who may access data. section 5.1.2 section 7.2.3
Regulated healthcare lakehouse
A healthcare analytics platform encrypts patient records at rest, retains access and modification trails, and uses storage such as ADLS or StorageGRID with granular policies and identity integration. section 5.5.2
Figure 5.2 Factors to consider when analyzing a storage layer’s security
Use the security-factor diagram to compare encryption with permissions, auditability, and location when evaluating a storage layer. section 5.1.2
