Finding Sensitive Data with Amazon Macie

You cannot protect data you do not know exists. Over time, S3 buckets fill with files, and somewhere among them may be customer PII, credentials, or financial records nobody remembers storing.

Amazon Macie solves this by automatically discovering and classifying sensitive data across your S3 storage.

Macie is a data security service that uses machine learning and pattern matching to find sensitive data in S3.

It identifies PII (personally identifiable information) such as names, addresses, and government IDs, plus financial and credential data — then reports where it lives and how exposed it is.

Macie runs discovery jobs that sample or scan objects in selected buckets and classify their contents.

A job produces findings detailing what type of sensitive data was found, in which object, and in what quantity. You can run jobs once or on a schedule to keep classifications current as data changes.

Macie ships with managed data identifiers for common types like credit-card numbers, AWS secret keys, and passport numbers.

You can also define custom data identifiers using regular expressions to catch organization-specific patterns — an internal account-number format, for example — so Macie understands what is sensitive to you.

Beyond content, Macie continuously evaluates your S3 security posture. It flags buckets that are publicly accessible, unencrypted, or shared with other accounts.

This inventory view answers a critical question at a glance: which buckets hold sensitive data and are also exposed? Those are your top priorities.

Macie produces two finding categories: sensitive data findings (this object contains PII) and policy findings (this bucket's settings are risky).

Each finding carries a severity and details. The highest-risk combination is sensitive data sitting in a bucket that is also publicly accessible or unencrypted.

Macie findings flow into AWS Security Hub in the normalized ASFF format, joining alerts from GuardDuty and other services in one place.

They can also trigger EventBridge rules, so discovering exposed PII can automatically launch a remediation workflow — for example, restricting the bucket or alerting the data owner.

Scanning every object continuously can be expensive, since Macie charges by the amount of data inspected.

Use sampling, target only buckets likely to hold sensitive data, and schedule jobs sensibly. Macie's automated discovery feature intelligently samples buckets to give broad coverage at a controlled cost.

Discovery is only valuable if you respond. When Macie finds PII in an exposed bucket, remediate: enable Block Public Access, turn on encryption, tighten the bucket policy, or move the data to a properly secured location.

Track findings to closure so sensitive data does not linger unprotected.

Macie's automated sensitive data discovery continuously samples buckets across your account, building an evolving map of where sensitive data lives without you scheduling individual jobs.

Pair it with scheduled deep-discovery jobs on your highest-risk buckets for thorough coverage that keeps pace as data is added and changed.

Regulations like GDPR, HIPAA, and PCI DSS require you to know where regulated data resides. Macie's automated discovery and reporting provide exactly that evidence.

It turns a manual, error-prone audit into a continuous, machine-driven process — strong support for both your security and your compliance obligations.

Identify Macie's core job.

Amazon Macie automatically discovers and classifies sensitive data like PII in S3 using machine learning, managed and custom data identifiers, and discovery jobs. It also evaluates bucket posture, flagging public or unencrypted buckets, so you can prioritize sensitive data that is also exposed. Findings flow to Security Hub and EventBridge for remediation, support compliance with GDPR and HIPAA, and should always be driven to resolution.