Amazon Macie
Find sensitive data in S3
Uses machine learning and pattern matching to detect sensitive data (PII, card numbers, credentials) in S3 and evaluates buckets that are public or unencrypted.
- Cost$$ Medium
- Difficulty●●●●●
- Costs money when idle?A little
- Serverless
- In examsCLF · SAA · SOA
Think of it asLike a baggage scanner looking for prohibited items in a records warehouse.
When to use it
✓ Use it when
You need to know where S3 holds PII for compliance (GDPR, PCI).
✗ Avoid it when
Scanning software vulnerabilities → Inspector; detecting attacks → GuardDuty.
Common uses
- Find buckets containing ID/card numbers
- Alert on public buckets
- Personal data compliance reports
What does it cost?
- Pricing model: Charged by the number of buckets monitored and GB of data scanned for sensitive data discovery.
⚠️ Cost traps
Scanning entire large buckets is expensive — use sampling or limit the job scope.
Related services
SAA-C03 study guide
Macie is covered in these study modules: