The PII Discovery Problem
Imagine your company has been running on AWS for five years. You have 800 S3 buckets accumulated across dozens of teams. Somewhere in those buckets — in CSV exports, log files, database dumps, and old backups — there may be credit card numbers, Social Security numbers, passport IDs, or medical records. You do not know which buckets, which files, or even which teams created them. Manually auditing this is impossible.
Amazon Macie is a managed data security service that uses machine learning to automatically discover, classify, and protect sensitive data stored in S3. It is purpose-built for compliance use cases: GDPR, HIPAA, PCI-DSS, and SOC 2 all require you to know where your sensitive data lives.
How Macie Works
Macie scans S3 objects and applies two types of detection:
-
Managed Data Identifiers: Pre-built ML models trained to recognize specific sensitive data types — credit card numbers (with Luhn checksum validation), AWS secret keys, driver's license numbers, passport numbers, medical record identifiers, and more. AWS maintains and updates these automatically.
-
Custom Data Identifiers: Regular expressions and keyword proximity rules you define for organization-specific sensitive data (e.g., your internal employee ID format:
EMP-[0-9]{6}).
What Macie reports:
- Sensitive Data Findings: "This S3 object contains 47 credit card numbers."
- Policy Findings: "This S3 bucket is publicly accessible and contains sensitive data." (This is the critical combination — sensitive data in a public bucket.)
Findings are published to EventBridge and AWS Security Hub, enabling automated alerting or remediation workflows. A common pattern is: Macie finding → EventBridge → SNS → PagerDuty alert to the security team, with a parallel Lambda that automatically sets the bucket ACL to private.
Macie is not free — it charges based on the number of S3 buckets evaluated per month and the volume of data scanned. For large environments, you can scope Macie to specific buckets or use sampling to control costs.