Amazon Macie
A data security service that uses machine learning to automatically discover sensitive data like PII and credit card numbers in S3 buckets
Overview
Amazon Macie is a data security service that automatically scans data stored in S3 buckets to detect sensitive data such as personally identifiable information (PII), credit card numbers, API keys, and passwords. Combining machine learning and regex pattern matching, it identifies sensitive data types for many countries and regions. Custom data identifiers let you define organization-specific patterns like employee IDs or customer IDs. Macie also automatically evaluates S3 bucket access settings (public access, encryption status, sharing configuration) to provide visibility into data security risks.
Two-Stage Detection Process and Custom Identifiers
Macie's sensitive data detection operates in two stages. First, it automatically creates an inventory of S3 buckets, cataloging object counts, sizes, encryption status, and public access settings per bucket. This inventory shows the security and access control settings of each bucket. Then, running a sensitive data discovery job scans objects in specified buckets (sampled or full scan) and outputs findings with the type, location, and count of sensitive data detected. Beyond the built-in managed data identifiers, which detect a large and growing list of sensitive data types for many countries and regions, custom data identifiers combine regex with proximity keywords - for example, detecting 8-digit numbers only when the keyword 'employee ID' appears within 50 characters - to reduce false positives while identifying organization-specific sensitive data like internal IDs, project codes, or proprietary data formats.
Data Inventory for Compliance Audits
One use of Macie is data inventory for compliance. For GDPR or PCI DSS audits, periodically scanning to identify which S3 buckets contain what types of sensitive data helps prepare for these audits. Macie findings can be aggregated in Security Hub alongside findings from GuardDuty and Inspector, creating a unified compliance dashboard. Microsoft Purview lists data sources such as Amazon S3, Azure Blob Storage, and Azure SQL in its documentation, while Macie focuses on data in S3. According to the official pricing page, bucket inventory and monitoring are charged per bucket, separately from sensitive data discovery (as of October 2026).
Automated Remediation Pipelines and Cost Management
Operationally, you can route Macie findings through EventBridge to Lambda for automated remediation. Examples include automatically applying S3 Object Lock to objects where sensitive data is detected, blocking public access on exposed buckets, or tagging objects with their classification level for downstream policy enforcement. For cost management, full scans of buckets with massive object counts can be expensive - sensitive data discovery jobs are charged based on data volume scanned, according to the official pricing page (as of October 2026). Using sampling rates (scanning a percentage of objects rather than all) or incremental scanning (targeting only objects added since the last scan) helps balance cost and detection coverage. One option is to combine full scans for compliance reporting with incremental scans for ongoing monitoring, adjusting the schedule based on how rapidly new data enters your S3 buckets.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- Amazon GuardDuty official page
- Amazon S3 official page
- AWS Security Hub official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.