Finding sensitive data with Macie
Lesson 5 of 5 in Encryption and Masking.
Every control in this module assumes you know where the sensitive data is. On a platform of any age that assumption is false: data arrives from systems whose schemas changed, lands in prefixes created for one-off analyses, gets copied into extracts, and ends up in places nobody threat-modelled. Amazon Macie exists to replace the assumption with evidence, and it has two modes that answer two different questions.
Automated sensitive data discovery answers "which of our buckets hold personal data?". Enabled once — ideally from the delegated administrator so it covers every member account — it samples objects continuously across the estate and maintains a sensitivity score per bucket. The numbers are worth knowing precisely: every bucket starts at 50 meaning not yet assessed, moves between 1 and 99 as evidence accumulates, and reads -1 when Macie could not analyse the bucket at all. That last value is a finding in its own right rather than a null — an unsupported object type, or more often a KMS key Macie has no permission on, which means a bucket you cannot see into.
A sensitive data discovery job answers "what exactly is in this bucket?". You point it at selected buckets or a bucket criteria expression, run it once or on a schedule, and get a finding per affected object naming the bucket, the object, the identifier matched, the number of occurrences and, when configured, the location of the match. Pricing is by bytes inspected, which is precisely why the sampling mode exists: sweep broadly and cheaply to find the candidates, then inspect deeply where it matters.
What Macie looks for is configured the same way in both modes. Managed data identifiers cover the formats the world shares — card numbers, national identifiers, credentials and keys, health and financial patterns across many countries. Custom data identifiers are where real coverage comes from, because managed identifiers know nothing about your internal customer reference or a partner's account scheme. A custom identifier is a regular expression, optionally narrowed by keywords that must appear within a maximum match distance, and by an ignore list. That proximity mechanism is the part to understand: a bare six-digit pattern matches far too much, while the same pattern required to sit near the word "policy" is precise. An allow list suppresses values that are genuinely fine — the sample card numbers in a test fixture, your own published phone numbers — because findings nobody acts on train everyone to ignore findings.
And the limit that decides exam questions: Macie reports. It never modifies, redacts, moves or deletes an object. Remediation is your pipeline's job, usually an EventBridge rule on the finding driving a quarantine, a tag, or a masking step. If a question offers Macie as the way to mask or remove data, it is the distractor.
| Tool | What it scans | Can it change the data? | Reach for it when |
|---|---|---|---|
Objects in Amazon S3 — sampled continuously, or inspected by job | No — findings only, remediation is yours to build | You need an inventory of where sensitive data already lives, across accounts | |
Rows and columns inside a running ETL job | Yes — redact, partially mask or hash in the same pass | The value must not reach the destination, or must arrive already masked | |
Free text — documents, tickets, transcripts, comment fields | Yes — detect and redact entities in text | The sensitive data is in prose, where no column-level control can reach it | |
Log events, at account or log-group level | Masks on read; the event still contains the value | “Engineers may read the log but must not see the identifiers in it” — | |
A dataset in a visual preparation recipe | Yes — masking, hashing and substitution transforms | Preparation work is being done visually rather than in code |
Key terms: Macie automated sensitive data discovery, Macie sensitivity score, Macie sensitive data discovery job, Custom data identifier, Macie allow list
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.