Skip to main content
implementing-aws-macie-for-data-classification Enable and configure Amazon Macie via AWS CLI/Terraform to discover, classify, and protect sensitive data (PII, financial data, credentials) in S3 using ML and pattern matching, including discovery jobs, custom data identifiers, allow lists, and EventBridge-based remediation. Use when setting up S3 data classification, cloud DLP, or auditing S3 for unprotected sensitive data.
跳到安装 Skills Marketplace 发现并探索由社区构建的 Agent Skills
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill implementing-aws-macie-for-data-classification命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
下载 Zip 下载中... 同仓库更多 Skills abusing-dpapi-for-credential-access Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
abusing-shadow-credentials-for-privesc Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
acquiring-disk-image-with-dd-and-dcfldd Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
name implementing-aws-macie-for-data-classification description Enable and configure Amazon Macie via AWS CLI/Terraform to discover, classify, and protect sensitive data (PII, financial data, credentials) in S3 using ML and pattern matching, including discovery jobs, custom data identifiers, allow lists, and EventBridge-based remediation. Use when setting up S3 data classification, cloud DLP, or auditing S3 for unprotected sensitive data. domain cybersecurity subdomain cloud-security tags ["aws","macie","data-classification","s3","pii","sensitive-data","dlp","compliance"] version 1.0 author mahipal license Apache-2.0 atlas_techniques ["AML.T0043","AML.T0018"] nist_ai_rmf ["GOVERN-1.1","GOVERN-4.2","MAP-2.3","MEASURE-2.7","MEASURE-2.5"] nist_csf ["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"] mitre_attack ["T1078.004","T1530","T1537","T1580","T1003"]
Implementing AWS Macie for Data Classification
Overview
Amazon Macie is a fully managed data security and privacy service that uses machine learning and pattern matching to discover and protect sensitive data in Amazon S3. Macie automatically evaluates your S3 bucket inventory on a daily basis and identifies objects containing PII, financial information, credentials, and other sensitive data types. It provides two discovery approaches: automated sensitive data discovery for broad visibility and targeted discovery jobs for deep analysis.
When to Use
When deploying or configuring implementing aws macie for data classification capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
AWS account with S3 buckets containing data to classify
IAM permissions for Macie service configuration
AWS Organizations setup (for multi-account deployment)
S3 buckets in supported regions
Enable Macie
Via AWS CLI
aws macie2 enable-macie
aws macie2 get-macie-session
aws macie2 update-automated-discovery-configuration \
--status ENABLED
Via Terraform
resource "aws_macie2_account" "main" {}
resource "aws_macie2_classification_export_configuration" "main" {
depends_on = [aws_macie2_account.main]
s3_destination {
bucket_name = aws_s3_bucket.macie_results.id
key_prefix = "macie-findings/"
kms_key_arn = aws_kms_key.macie.arn
}
}
Configure Discovery Jobs
Create a classification job for specific buckets
aws macie2 create-classification-job \
--job-type ONE_TIME \
--name "pii-scan-production-buckets" \
--s3-job-definition '{
"bucketDefinitions": [{
"accountId": "123456789012",
"buckets": [
"production-data-bucket",
"customer-records-bucket"
]
}]
}' \
--managed-data-identifier-selector ALL
Create a scheduled recurring job
aws macie2 create-classification-job \
--job-type SCHEDULED \
--name "weekly-sensitive-data-scan" \
--schedule-frequency-details '{
"weekly": {
"dayOfWeek": "MONDAY"
}
}'
'{
"bucketDefinitions": [{
"accountId": "123456789012",
"buckets": ["all-data-bucket"]
}],
"scoping": {
"includes": {
"and": [{
"simpleScopeTerm": {
"comparator": "STARTS_WITH",
"key": "OBJECT_KEY",
"values": ["uploads/", "documents/"]
}
}]
}
}
}'
Custom Data Identifiers
Create a custom identifier for internal IDs aws macie2 create-custom-data-identifier \
--name "internal-employee-id" \
--description "Matches internal employee ID format EMP-XXXXXX" \
--regex "EMP-[0-9]{6}" \
--severity-levels '[
{"occurrencesThreshold": 1, "severity": "LOW"},
{"occurrencesThreshold": 10, "severity": "MEDIUM"},
{"occurrencesThreshold": 50, "severity": "HIGH"}
]'
Create identifier for project codes aws macie2 create-custom-data-identifier \
--name "project-code-identifier" \
--description "Matches project codes in format PRJ-XXXX-XX" \
--regex "PRJ-[A-Z]{4}-[0-9]{2}" \
--keywords '["project", "code", "initiative"]' \
--maximum-match-distance 50
Allow Lists
Create an allow list to suppress false positives aws macie2 create-allow-list \
--name "test-data-exclusions" \
--description "Exclude known test data patterns" \
--criteria '{
"regex": "TEST-[0-9]{4}-[0-9]{4}-[0-9]{4}-[0-9]{4}"
}'
Managed Data Identifiers Macie provides 300+ managed data identifiers covering:
Category Examples PII SSN, passport numbers, driver's license, date of birth, names, addresses Financial Credit card numbers, bank account numbers, SWIFT codes Credentials AWS secret keys, API keys, SSH private keys, OAuth tokens Health HIPAA identifiers, health insurance claim numbers Legal Tax identification numbers, national ID numbers
Findings Management
List findings
aws macie2 list-findings \
--finding-criteria '{
"criterion": {
"severity.description": {
"eq": ["High"]
},
"category": {
"eq": ["CLASSIFICATION"]
}
}
}' \
--sort-criteria '{"attributeName": "updatedAt", "orderBy": "DESC"}' \
--max-results 25
Get finding details aws macie2 get-findings \
--finding-ids '["finding-id-1", "finding-id-2"]'
Export findings to Security Hub
aws macie2 get-macie-session --query 'findingPublishingFrequency'
EventBridge Integration for Automated Response {
"source" : [ "aws.macie" ] ,
"detail-type" : [ "Macie Finding" ] ,
"detail" : {
"severity" : {
"description" : [ "High" , "Critical" ]
}
}
}
Lambda function for automated remediation import boto3
import json
s3 = boto3.client('s3' )
sns = boto3.client('sns' )
def lambda_handler (event, context ):
finding = event['detail' ]
severity = finding['severity' ]['description' ]
bucket = finding['resourcesAffected' ]['s3Bucket' ]['name' ]
key = finding['resourcesAffected' ]['s3Object' ]['key' ]
sensitive_types = [d['type' ] for d in finding.get('classificationDetails' , {}).get('result' , {}).get('sensitiveData' , [])]
if severity in ['High' , 'Critical' ]:
s3.put_object_tagging(
Bucket=bucket,
Key=key,
Tagging={
'TagSet' : [
{'Key' : 'macie-finding' , 'Value' : severity},
{'Key' : 'sensitive-data' , 'Value' : ',' .join(sensitive_types)},
{'Key' : 'requires-review' , 'Value' : 'true' }
]
}
)
sns.publish(
TopicArn='arn:aws:sns:us-east-1:123456789012:security-alerts' ,
Subject=f'Macie {severity} Finding: {bucket} /{key} ' ,
Message=json.dumps({
'bucket' : bucket,
'key' : key,
'severity' : severity,
'sensitive_data_types' : sensitive_types,
'finding_id' : finding['id' ]
}, indent=2 )
)
return {'statusCode' : 200 }
Multi-Account Deployment
Designate Macie administrator account
aws macie2 enable-organization-admin-account \
--admin-account-id 111111111111
Add member accounts
aws macie2 create-member \
--account '{"accountId": "222222222222", "email": "security@example.com"}'
Monitoring Macie Operations
Usage statistics aws macie2 get-usage-statistics \
--filter-by '[{"comparator": "GT", "key": "accountId", "values": []}]' \
--sort-by '{"key": "accountId", "orderBy": "ASC"}'
Classification job status aws macie2 list-classification-jobs \
--filter-criteria '{"includes": [{"comparator": "EQ", "key": "jobStatus", "values": ["RUNNING"]}]}'
References 