implementing-aws-macie-for-data-classification

name	implementing-aws-macie-for-data-classification
description	Implement Amazon Macie to automatically discover, classify, and protect sensitive data in S3 buckets using machine learning and pattern matching for PII, financial data, and credentials detection.
domain	cybersecurity
subdomain	cloud-security
tags	["aws","macie","data-classification","s3","pii","sensitive-data","dlp","compliance"]
version	1.0
author	mahipal
license	Apache-2.0
atlas_techniques	["AML.T0043","AML.T0018"]
nist_ai_rmf	["GOVERN-1.1","GOVERN-4.2","MAP-2.3","MEASURE-2.7","MEASURE-2.5"]
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

Implementing AWS Macie for Data Classification

Overview

Amazon Macie is a fully managed data security and privacy service that uses machine learning and pattern matching to discover and protect sensitive data in Amazon S3. Macie automatically evaluates your S3 bucket inventory on a daily basis and identifies objects containing PII, financial information, credentials, and other sensitive data types. It provides two discovery approaches: automated sensitive data discovery for broad visibility and targeted discovery jobs for deep analysis.

When to Use

• When deploying or configuring implementing aws macie for data classification capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Common Misconfigurations & Verification

• Automated discovery never enabled: enabling Macie (enable-macie) does NOT start scanning. Run update-automated-discovery-configuration --status ENABLED and confirm with get-automated-discovery-configuration (must return status: ENABLED).
• Customer-managed CMK objects silently skipped: Macie cannot read objects encrypted with a customer-managed KMS key unless its service-linked role is granted kms:Decrypt. Such objects appear under unclassifiableObjectCount, not as findings. Check: aws macie2 describe-buckets --query 'buckets[?unclassifiableObjectCount.total>0].[bucketName,unclassifiableObjectCount.total]'.
• Job scoping excludes real data: an OBJECT_EXTENSION/OBJECT_KEY scope term that omits the actual prefixes/extensions means the job runs but classifies nothing. Verify the job actually processed objects via list-classification-jobs --query 'items[].statistics'.
• Findings lost after 90 days: sensitive-data findings auto-expire and are not retained unless you set an S3 export. Confirm aws macie2 get-classification-export-configuration returns a destination bucket + KMS key.
• Security Hub integration assumed: findings only flow to Security Hub if both services are enabled in the same region; check findingPublishingFrequency and that Security Hub shows the Macie product.
• Multi-account gaps: new org accounts are not auto-covered. After , set auto-enable and confirm members with Enabled.