Visual overview
Macie inspects eligible S3 data for sensitive patterns, while KMS can protect retained results and sensitive S3 data according to the chosen encryption design.
Technical reference
Macie classification is driven by identifier criteria and scan scope; the classification result should then inform separate access and encryption controls.
AWS-maintained identifiers detect supported credential, financial, personal and other sensitive-data types using type-specific criteria.
A custom data identifier starts with a regex that defines the text pattern Macie should detect.
Optional keywords and a proximity distance require a regex match to occur near relevant context.
Configured values can exclude known non-sensitive matches from custom-identifier results.
Macie samples representative S3 objects over time to maintain broad visibility into the data estate.
A job explicitly defines which eligible S3 objects and classification criteria to analyze.
Macie maps sensitive data inside the S3 estate
Amazon Macie is a data security service focused on Amazon S3. It helps discover, classify, and report sensitive data in S3 objects and provides visibility into aspects of the bucket estate. Sensitive-data use cases include personally identifiable information, financial information, credentials, health-related identifiers, and organization-specific patterns. Macie is therefore about the contents and exposure context of stored data rather than compute CVEs or runtime threat behavior.
Two discovery models are important. Automated sensitive data discovery continually evaluates the S3 inventory and selects representative objects for analysis, building a broad view without requiring a hand-authored job for every bucket. Sensitive data discovery jobs are explicit analysis tasks with a chosen scope and configuration. Jobs are better when the team needs a targeted scan of selected buckets, prefixes, criteria, or a specific compliance investigation.
Data identifiers turn text into classification signals
Macie provides managed data identifiers for common sensitive-data types. A managed identifier uses AWS-maintained criteria that can include patterns, keywords, checksum logic, and proximity requirements depending on the data type. Selecting appropriate identifiers matters because scanning every possible identifier is not equivalent to a precise data-classification policy; organizations should align detection with the classes of data they actually need to locate and protect.
Custom data identifiers support proprietary patterns. The core is a regular expression that describes candidate text. Optional keywords, an adjustable maximum match distance, and ignore words can narrow the result so the regex match is considered sensitive only in the right surrounding context. This is a useful technical distinction: the regex detects a pattern, while proximity and exclusion criteria help reduce false positives.
Findings are alerts; discovery results are the analysis record
When Macie detects sensitive data that meets finding criteria, it generates sensitive-data findings that identify the affected S3 object and classification context without exposing the sensitive content as the purpose of the finding. Macie also creates discovery results for analyzed objects, including objects where no sensitive data was detected or analysis could not be completed. Detailed results can be configured for secure retention in an S3 repository encrypted with a specified KMS key.
Allow lists can reduce noise for known benign values, while custom identifiers add organization-specific patterns. Neither should be used to hide genuine sensitive data merely to improve dashboard counts. The useful operating cycle is inventory → discover → validate → remediate access, location, retention, or encryption → scan again. S3 access controls and data classification complement each other: Macie can tell you what deserves protection, while IAM, bucket controls, and KMS decide how that protection is enforced.
Key takeaways
- 01
Macie discovers and classifies sensitive data in Amazon S3 objects.
- 02
Automated discovery provides broad ongoing visibility; discovery jobs provide explicitly scoped analysis.
- 03
Managed data identifiers cover common sensitive-data classes, while custom identifiers use regex plus optional proximity and exclusion criteria.
- 04
Sensitive-data findings and detailed discovery results serve different investigation purposes.
- 05
Macie identifies sensitive data; S3 permissions and KMS encryption remain enforcement controls.
Official AWS sources
Use these primary AWS resources for the source material behind this article and for deeper reference.