What Amazon Macie is
Most organizations cannot say with confidence which of their Amazon S3 buckets hold personal data, card numbers or credentials. That gap matters for privacy laws, for incident response and for deciding which buckets deserve the tightest controls.
Amazon Macie is the AWS data security service built for this. It uses machine learning and pattern matching to discover sensitive data in S3, and it continuously evaluates your S3 general purpose buckets for security and access control. AWS first announced Macie in August 2017 and released a redesigned version in May 2020, which is the service you use today.
Macie finds and reports. It does not change bucket policies, encrypt objects or block access by itself. Remediation is done by you or by automation you build on its findings.
Bucket inventory and policy findings
As soon as you enable Macie in a Region, it builds an inventory of your S3 general purpose buckets and starts monitoring them. For each bucket it shows public access settings, encryption settings, whether the bucket is shared with other AWS accounts, and how much of its content Macie can analyze.
When it detects a potential problem, such as a bucket that becomes publicly accessible or has its Block Public Access settings turned off, Macie creates a policy finding such as Policy:IAMUser/S3BucketPublic or Policy:IAMUser/S3BucketSharedExternally. Policy findings are raised only for changes made after you enable Macie, so also review the bucket inventory for settings that were already risky. These findings need no scanning of object contents, so they are a cheap first layer of visibility.
Two ways to discover sensitive data
Macie offers two complementary ways to inspect object contents.
Automated sensitive data discovery
Automated sensitive data discovery gives broad, ongoing coverage. Macie continually evaluates your bucket inventory, uses sampling to select representative objects from each bucket, and inspects them. By default it covers all your general purpose buckets, and you can exclude buckets such as those that only hold AWS service logs.
As analysis progresses each day, Macie updates a sensitivity score for each bucket and an interactive map of your data estate. This is the fastest way to answer “where is our sensitive data likely to be?” without paying to scan every object.
Sensitive data discovery jobs
Sensitive data discovery jobs are for deeper, targeted analysis. You choose the buckets, the sampling depth and object criteria such as file type, prefix, size or last modified date. A job can run once, for example during an audit or after an incident, or on a daily, weekly or monthly schedule to pick up new objects.
A common pattern is to let automated discovery point out buckets with high sensitivity scores, then run a full job on those buckets.
Data identifiers and allow lists
Macie decides what counts as sensitive data with data identifiers:
- Managed data identifiers are built in. They detect many types of personally identifiable information, financial information and credentials, for many countries and regions. You can use the recommended set or choose specific ones.
- Custom data identifiers are your own rules: a regular expression, optional keywords that must appear near the match, words to ignore, and a maximum match distance. They suit internal formats such as employee or customer IDs.
- Allow lists tell Macie to ignore specific text or patterns, such as your company’s public phone numbers or known test data.
Creating a custom data identifier with the AWS CLI:
aws macie2 create-custom-data-identifier \
--name "employee-id" \
--regex "EMP-[0-9]{6}" \
--keywords "employee" "staff id" \
--maximum-match-distance 50Test custom identifiers against sample text before you use them widely. A loose pattern produces many false positives, and every finding costs someone time.
Findings, results and where they go
When Macie detects sensitive data in an object, it creates a sensitive data finding, such as SensitiveData:S3Object/Personal or SensitiveData:S3Object/Credentials, with a severity, the affected object and the types and counts of data found. It also records a sensitive data discovery result for every object it analyzes. Macie keeps findings for 90 days, so for a long-term record configure a repository: an S3 bucket, encrypted with an AWS KMS key, where Macie stores discovery results.
To act on findings automatically:
- Macie publishes every finding to Amazon EventBridge. A rule can send them to AWS Lambda, Amazon SNS, AWS Step Functions or a ticketing system.
- Macie can also publish findings to AWS Security Hub CSPM, so they sit alongside findings from other services and can be aggregated across Regions.
An EventBridge event pattern that matches all Macie findings:
{
"source": ["aws.macie"],
"detail-type": ["Macie Finding"]
}Typical automated responses are opening a ticket for the data owner, tagging the object, or, for a public bucket with sensitive data, turning on S3 Block Public Access after an approval step.
Running Macie across many accounts
Macie integrates with AWS Organizations. You designate a delegated Macie administrator account, which can enable Macie for member accounts, review their bucket inventory and policy findings, and run discovery jobs and automated discovery across their buckets. Macie is a Regional service, so enable it in every Region where you store S3 data.
Cost and practical tips
Macie pricing has separate parts for bucket evaluation, for objects monitored by automated discovery, and for the data inspected. New accounts get a 30-day free trial that covers bucket evaluation and, depending on settings, automated discovery, but not discovery jobs. Macie shows estimated usage costs in the console.
To keep cost and noise under control:
- Start with automated discovery and use its scores to decide where to run full jobs.
- Exclude buckets that only contain logs or other data you know is not sensitive.
- Use object criteria in jobs so you do not scan the same unchanged objects again.
- Tune allow lists and custom identifiers early.
- Agree who owns each finding type before you turn on alerts.
Where Macie fits
Macie covers one important part of data protection: knowing where sensitive data lives in S3 and whether those buckets are exposed. It works best alongside S3 Block Public Access, default encryption, least-privilege IAM, AWS CloudTrail data events and Amazon GuardDuty threat detection.
9Acts is an AWS Advanced Tier Services Partner with the AWS Level 1 MSSP Competency. If you want help setting up Macie and acting on what it finds, see our security and compliance services.