Amazon Macie
Amazon Macie is a security service of Amazon Web Services that uses machine learning and pattern matching to locate, categorize, and safeguard sensitive data stored in Amazon S3.
AI Practitioner focus
- Macie discovers/classifies sensitive data in Amazon S3 and generates findings that support data inventory and privacy controls before training or RAG ingestion.
- Macie does not automatically anonymize, mask, or delete the data. A separate governed processing workflow must perform those transformations.
Key points
- Automatically evaluates and monitors S3 general purpose buckets for security and access control, generating findings for issues such as a bucket that becomes publicly accessible.
- Identifies sensitive data such as credit card numbers, other personally identifiable information (PII), API keys, access credentials, and intellectual property, using managed data identifiers (built-in) and optional custom data identifiers (user-defined regex).
- Uses machine learning and pattern matching to identify/classify sensitive data and generate findings; remediation, masking, anonymization, and deletion require separate customer-controlled workflows.
- Offers two discovery modes: automated sensitive data discovery, which continually samples representative objects across the whole S3 estate for ongoing, low-cost visibility, and sensitive data discovery jobs, which run deeper, targeted (one-time or scheduled) analysis over buckets you specify.
- Does not perform general threat detection across accounts, workloads, or network traffic — that is Amazon GuardDuty. Does not scan EC2 instances for software vulnerabilities — that is Amazon Inspector.
- Findings can be investigated further with Amazon Detective to determine root cause, or aggregated and prioritized in AWS Security Hub (now AWS Security Hub CSPM).
- Scope is Amazon S3 only — Macie discovers and classifies sensitive data (PII, financial data, credentials, intellectual property, etc.) exclusively within S3. It does not scan Amazon Elastic Block Store (EBS) volumes, Amazon RDS databases, or Amazon DynamoDB tables; a common exam trap is assuming Macie provides sensitive-data discovery across all storage services.