Amazon Macie
Amazon Macie is a data security service for Amazon S3. It does two distinct jobs: it discovers and reports sensitive data inside objects, and it evaluates and monitors S3 general purpose buckets for security and access-control problems.
Sensitive data discovery
Section titled “Sensitive data discovery”Macie detects sensitive data using managed data identifiers — built-in machine learning and pattern-matching criteria covering many types of personally identifiable information, financial information and credentials, across many countries — and custom data identifiers, which are regular expressions with optional proximity rules for organisation-specific data. Allow lists define text Macie should ignore, such as an organisation’s own published phone numbers or test fixtures.
Discovery runs in two modes:
- Automated sensitive data discovery continually evaluates the bucket inventory and samples representative objects, giving broad visibility into where sensitive data is likely to be.
- Sensitive data discovery jobs are targeted and deeper. The job defines which buckets to analyse, the sampling depth and the criteria, and runs once or on a schedule.
Bucket security monitoring
Section titled “Bucket security monitoring”When Macie is enabled it builds and maintains an inventory of S3 general purpose buckets and monitors them. It raises a policy finding when a bucket becomes publicly accessible, is shared with an AWS account outside the organisation, or has encryption settings that create risk. Per-bucket detail includes the public-access and encryption settings and how much of the bucket Macie is able to analyse.
Integration
Section titled “Integration”Macie publishes findings to Amazon EventBridge as events, which is the usual route to SNS notifications, Lambda remediation or a ticketing system. It can also publish to AWS Security Hub CSPM for aggregation alongside GuardDuty and Inspector findings. In a multi-account estate, a designated Macie administrator manages member accounts through AWS Organizations.
Findings and inventory make Macie the practical starting point for demonstrating control of personal data under regimes such as the UK GDPR and HIPAA, because it answers the question those regimes actually ask: where is the data.