AWS Certified Security – SpecialtyDomain 5: Data ProtectionEasy
A global e-commerce company uses Amazon S3 to store customer order data, which is classified into 'Public', 'Internal', and 'Confidential' based on its sensitivity. The security team needs to automatically discover and classify new objects uploaded to S3 into these categories and identify any 'Confidential' data that might be inadvertently exposed. Which AWS service is best suited for this task?
- AAWS Config rules to monitor S3 bucket policies for public access.
- BAmazon GuardDuty to detect unusual and unauthorized behavior in S3.
- CAWS CloudTrail to log S3 API calls and analyze for sensitive data access patterns.
- DAmazon Macie to discover, classify, and protect sensitive data in S3.
Show answer & explanationAnswer & explanation
Correct answer: D. Amazon Macie to discover, classify, and protect sensitive data in S3.
Amazon Macie is specifically designed for data discovery and classification in Amazon S3. It uses machine learning to identify sensitive data (like PII, financial data) and provides visibility into data access and security posture, making it ideal for the described scenario.
Why the other options are wrong
- A. AWS Config monitors resource configurations and compliance, but doesn't perform data classification or discovery within objects.
- B. Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not for data classification or discovery within S3 objects.
- C. AWS CloudTrail logs API activity, useful for auditing access, but not for discovering and classifying data content within objects.
Amazon Macie
A data security and data privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data in AWS, primarily in Amazon S3.
- Automatically discovers sensitive data (PII, financial, etc.).
- Provides visibility into S3 bucket security and access.
- Helps identify and prevent data leaks.
Memory trick: Macie finds the sensitive, labels the data, keeps it protected.