AWS Certified Security – SpecialtyDomain 5: Data ProtectionEasy
A global e-commerce company uses Amazon S3 to store customer order data, which is classified as 'Confidential' and 'Public'. The security team needs to automatically identify and classify new objects uploaded to S3 that contain personally identifiable information (PII) such as credit card numbers or social security numbers, especially those incorrectly marked as 'Public'. This process should also trigger alerts for misclassified sensitive data. Which AWS service can accomplish this most efficiently?
- AAWS CloudTrail logs analyzed by Amazon Athena for PII patterns.
- BAWS Config rules to monitor S3 object tags and trigger Lambda functions.
- CAmazon Macie configured to discover and classify sensitive data in S3.
- DCustom Lambda functions triggered by S3 PUT events to scan object content.
Show answer & explanationAnswer & explanation
Correct answer: C. Amazon Macie configured to discover and classify sensitive data in S3.
Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data in AWS. It can automatically identify PII and financial data in S3 and generate findings for misclassified data, directly addressing the company's requirements.
Why the other options are wrong
- A. CloudTrail logs API activity, not object content. While Athena can query logs, it would be highly inefficient and complex to detect PII within object data via CloudTrail.
- B. AWS Config monitors resource configurations and compliance, but it does not scan object content for PII or automatically classify data based on content.
- D. Custom Lambda functions can scan objects, but this requires significant development, maintenance, and expertise to build and keep PII detection patterns up-to-date, which is less efficient than a managed service like Macie.
Amazon Macie for S3 Data Classification
Amazon Macie is a data security and privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data, such as PII, in Amazon S3.
- Automated sensitive data discovery in S3
- Identifies PII, financial data, and other sensitive information
- Generates findings for misclassified or exposed data
- Fully managed service, reducing operational overhead
Memory trick: Macie Makes Auditing Classifications Easy.