Amazon Macie

What it is

Amazon Macie is a data security service that discovers sensitive data in Amazon S3 using ML (Machine learning)Software that learns patterns from example data to make predictions or decisions, instead of following rules written by hand. A model is first trained on data, then used to make predictions on new data, which is called inference.Glossary entry and pattern matching, gives visibility into data security risks, and helps automate protection. Macie keeps an inventory of your S3 general purpose buckets and continuously evaluates them for security and access control. For example, it generates a finding when a bucket becomes publicly accessible.

Choose Macie when a question asks to find PII (Personally identifiable information)Information that can identify a person, alone or combined with other data, such as a name, email address, or passport number. Amazon Macie finds PII in Amazon S3.Glossary entry (PII), financial data, or credentials stored in S3, or to monitor S3 buckets for public access or unencrypted data across an organization.

Concepts

Automated sensitive data discovery: Macie continually samples objects across your buckets to estimate where sensitive data lives, with no jobs to configure.
Sensitive data discovery jobs: run one-time or scheduled jobs on chosen buckets for complete analysis.
Managed data identifiers: built-in detection for many types of sensitive data, such as names, addresses, credit card numbers, and credentials.
Custom data identifiers: your own patterns (regular expressions, with optional keywords), such as employee or customer IDs.
Findings:
- Policy findings: issues with a bucket's security or privacy, such as public access or disabled encryption.
- Sensitive data findings: sensitive data found in an object.
- Macie stores findings for 90 days and publishes them to Amazon EventBridge for automated response, and to AWS Security Hub.
Multi-account: with AWS Organizations, a delegated administrator manages Macie across accounts.

Security, resilience, performance, and cost

Security: find and fix exposed sensitive data; combine with S3 Block Public Access and encryption.
Cost: three dimensions: the number of S3 buckets evaluated for inventory and monitoring, the number of S3 objects monitored for automated discovery, and the quantity of data inspected by automated and targeted discovery.

Macie or another option?

If the requirement is	Choose
Find PII or credit card numbers in S3	Amazon Macie
Alert when an S3 bucket becomes public	Macie policy findings (and IAM Access Analyzer)
Detect PII in text passed to an application	Amazon Comprehend PII detection
Detect threats to S3 data, such as suspicious access	GuardDuty S3 Protection
Block all public access to buckets	S3 Block Public Access

Reverse mindmap: when the question points here

Is it Amazon Macie?

Yes, when the question says
- Find sensitive data or PII in S3 leads to Macie
- Credit card or passport numbers in buckets leads to Macie managed data identifiers
- Our own ID formats leads to Custom data identifiers
- Bucket became public or unencrypted leads to Macie policy findings
Run it
- Continuous sampling without jobs leads to Automated sensitive data discovery
- Full scan of chosen buckets leads to Sensitive data discovery job
- Act on findings leads to EventBridge
- All accounts leads to Organizations delegated administrator
No, when the question says
- Threat detection leads to GuardDuty
- PII in free text in an app leads to Comprehend

Key takeaways

Macie discovers sensitive data in S3 with machine learning and pattern matching, and monitors bucket security.
Use automated sensitive data discovery for continuous coverage, or discovery jobs for full scans.
Managed and custom data identifiers define what counts as sensitive.
Policy findings cover bucket security; sensitive data findings cover object contents; both go to EventBridge and Security Hub.