Amazon Macie

Amazon Macie is a fully managed data security and privacy service that uses machine learning and pattern matching to discover and protect sensitive data in S3.

What It Detects

• PII: names, addresses, SSNs, passport numbers, driver's licenses
• Financial: credit card numbers, bank account numbers
• Health: PHI, medical record numbers, health insurance IDs
• Credentials: AWS secret keys, API keys, private keys, database connection strings
• Custom Data Identifiers: regex patterns for your organization's specific data types

Key Features

• Automated Discovery: samples and analyzes S3 objects automatically across buckets
• Bucket-level Security Assessment: public access, encryption, replication, shared access
• Sensitive Data Discovery Jobs: targeted scanning of specific buckets with scheduling
• Multi-account: manage via Organizations delegated administrator
• Findings: sent to Security Hub and EventBridge for automated remediation

How Automated Discovery Actually Works

Macie does not scan every object. Each day it evaluates your S3 inventory, identifies objects eligible for analysis, and uses sampling to select representative objects. The sampling groups objects by dimensions like bucket name, prefix, storage class, file extension, and last modified date, then picks a representative set from each group, retrieves the latest version, analyzes it, and discards its copy.

The strategy is breadth-first: it spreads across as many general purpose buckets as possible rather than exhausting one, so you get a wide sensitivity picture quickly. Depending on the size of your estate, results can begin appearing within 48 hours. Recently created or changed objects are prioritized, and an object that was already analyzed and has not changed is not analyzed again.

Each bucket gets a sensitivity score that reflects both how much sensitive data Macie found and how much of the bucket it has analyzed. When you first enable automated discovery, every bucket is assigned a score of 50 with the Not yet analyzed label, except empty buckets, which get a score of 1 and the Not sensitive label. You can manually override a bucket's score by assigning the maximum of 100, which forces the Sensitive label. You can exclude up to 1000 buckets from analysis, which is how you keep CloudTrail log buckets and similar noise out of the results.

How It Goes Wrong in Practice

The most common disappointment is enabling Macie, seeing a wall of buckets scored 50 and labelled Not yet analyzed, and concluding it is broken. It is not: 50 is the starting score before analysis, and it is also the score Macie reports when a bucket's permissions prevent it from reading the bucket or its objects at all. Those two very different situations look identical in the inventory. The way to distinguish them is the coverage data, which shows exactly which buckets Macie could not analyze and why. Skipping that step means you can run Macie for months while your most locked-down (and often most sensitive) buckets are silently uncovered.

The second trap is encryption. Macie can analyze an encrypted object only if it is encrypted with a key that Macie can access and is allowed to use. A bucket encrypted with a customer managed KMS key whose key policy does not grant the Macie service-linked role produces no findings, not a failure you would notice without checking coverage. If you have a strict key policy standard, plan the Macie grant into it.

Third, teams forget that automated discovery settings are per Region. The settings, the analyses, and the results all apply only to the current Region, so enabling Macie in your main Region tells you nothing about that forgotten bucket in another Region. Enable and configure it in every Region you use. In an organization, only the Macie administrator can enable or disable automated discovery for member accounts, and the administrator's settings (excluded buckets, data identifiers, allow lists) are what get applied to member data. Members cannot see or change them, and only the administrator has direct access to the findings automated discovery produces.

Checking the Configuration From the CLI

To see whether automated sensitive data discovery is on and how it is scoped:

aws macie2 get-automated-discovery-configuration

The command takes no required parameters. The output includes status (ENABLED or DISABLED), autoEnableOrganizationMembers (ALL, NEW, or NONE), classificationScopeId (which identifies the scope defining excluded buckets), sensitivityInspectionTemplateId (allow lists and data identifiers in use), firstEnabledAt, lastUpdatedAt, and disabledAt. Run it in each Region you care about, and pay attention to autoEnableOrganizationMembers: if it is NEW, accounts that existed before you enabled Macie are not covered.

Frequently Asked Questions

Does Macie scan every object in my buckets?

No. Automated sensitive data discovery samples representative objects continuously. If you need exhaustive coverage of a specific bucket, for example before an audit or after an incident, run a sensitive data discovery job targeted at that bucket. The two mechanisms are complementary: automated discovery for broad visibility, jobs for depth.

Does Macie see my data?

Macie retrieves the selected object, analyzes it, and discards its copy. It records findings and discovery results describing what it found and where, not the data itself. Findings can include a limited number of occurrences to help you locate the data, so treat the findings themselves as sensitive and control access to them.

What does a sensitivity score of 50 mean?

It is the default starting point, not a measurement. A bucket sits at 50 with the Not yet analyzed label until Macie has analyzed objects in it, or if Macie cannot access the bucket at all. Check the coverage data before treating a 50 as a result.