Amazon Macie
Managed service that discovers sensitive data in Amazon S3 and flags risky bucket configurations.
Verified against AWS documentation · 2026-08-24
Key facts
- 01Amazon S3 only — general purpose buckets; nothing for RDS, EBS, DynamoDB, or EFS
- 02Two discovery modes: automated (daily sampling, sensitivity score per bucket) and discovery jobs (targeted, one-time or scheduled)
- 03Detects using managed data identifiers (PII, financial, credentials) plus custom regex identifiers; allow lists suppress known-safe matches
- 04Two finding types: policy (bucket public, unencrypted, shared outside the org) and sensitive data (what's inside the object)
- 05Limits: findings and discovery results kept 90 days, 10,000 buckets inventoried per account, 15 detection locations per finding, regional — enable per Region
Exam triggers
Phrases and scenarios that point here.
- "Discover PII", "find credit card numbers", "detect credentials" in S3 → Macie
- "GDPR / HIPAA / PCI-DSS" + "where does our sensitive data live" → Macie, not Config
- Alert when a bucket holding customer data becomes public → Macie policy finding → EventBridge → Lambda
- Sensitive data sitting outside S3 → export it to S3 first, then Macie
Not this service
- Threat detection from CloudTrail, VPC Flow, or DNS logs → GuardDuty
- Resource configuration drift and compliance rules → AWS Config
- OS, package, and CVE scanning for EC2/ECR/Lambda → Inspector
- Redacting PII from text at request time → Comprehend
Use cases
- 01Pre-handoff audit — scan a legacy bucket before shipping the data dump to a partner, so you find out you're exporting customer PII before they do
- 02Credential leak sweep — dev exports, CloudFormation outputs, and .env backups that a CI job quietly pushed to S3
- 03Data lake landing zone guardrail — a scheduled job on the raw ingest prefix so a new upstream feed can't silently start writing SSNs into the lake
- 04Inherited-account triage — enable Macie org-wide after an acquisition and use bucket sensitivity scores to decide which of 400 unknown buckets to open first
- 05Automated containment — policy finding on a bucket going public routes through EventBridge to a Lambda that re-applies Block Public Access and pages the owner
How it's charged
- 01Three dimensions: number of buckets evaluated for inventory and monitoring, number of objects monitored for automated discovery, and GB of data inspected
- 02Bucket monitoring is per bucket per month, prorated daily — a thousand near-empty buckets costs the same as a thousand large ones
- 03Discovery is per GB inspected, so scope jobs with prefixes, object size criteria, and sampling depth instead of pointing them at whole buckets
- 04Jobs also generate normal S3 GET and LIST request charges, which land on the S3 bill, not the Macie line item
- 0530-day free trial per account per Region, plus 1 GB/month of discovery at no cost; unsupported file formats and storage classes aren't inspected, so they aren't billed
