AWS Certified Security – SpecialtyDomain 5: Data ProtectionMedium
A global e-commerce company uses Amazon S3 to store customer order data, which is classified into 'Public,' 'Internal,' and 'Confidential' categories. The security team wants to automatically identify and classify any newly uploaded objects that contain personally identifiable information (PII) or other sensitive data, regardless of their initial classification, and then trigger an alert. Which AWS service should be used to achieve this continuous and automated data classification and alerting?
- AAWS Config rules to monitor S3 bucket policies for sensitive data access.
- BAWS CloudTrail to log S3 object uploads and analyze logs for sensitive keywords.
- CAmazon Rekognition to detect sensitive content in images and videos uploaded to S3.
- DAmazon Macie to discover, classify, and protect sensitive data in S3.
Show answer & explanationAnswer & explanation
Correct answer: D. Amazon Macie to discover, classify, and protect sensitive data in S3.
Amazon Macie is specifically designed to discover, classify, and report on sensitive data, such as PII, in Amazon S3 buckets. It provides automated continuous monitoring and can generate alerts.
Why the other options are wrong
- A. AWS Config monitors resource configurations and compliance, but it does not perform content-based data classification within S3 objects.
- B. AWS CloudTrail logs API activity, but it does not inspect the content of S3 objects for sensitive data; analyzing logs for keywords would be a custom, less effective solution.
- C. Amazon Rekognition is for image and video analysis (e.g., facial recognition, text in images), not for classifying PII within general document or data files in S3.
Amazon Macie for S3 Data Classification
Amazon Macie is a data security service that uses machine learning and pattern matching to discover, classify, and protect sensitive data (like PII) in Amazon S3, providing continuous monitoring and alerts.
- Automatically discovers sensitive data like PII, financial data, and credentials.
- Provides visibility into S3 bucket security and access.
- Generates findings and alerts for sensitive data exposures or policy violations.
Memory trick: Macie Makes S3 Secrets Scrutinized and Signaled.