Skip to main content
This guide demonstrates how to use Amazon Macie to discover sensitive data stored in Amazon S3 buckets. The walkthrough covers enabling Macie, preparing and uploading test data, creating a sensitive data discovery job, reviewing findings, and common integrations and configuration tips for production use.
Before you begin, be aware that Amazon Macie incurs service charges based on the data scanned and the number of findings. Ensure you have appropriate IAM permissions (for Macie and S3) and monitor costs while testing.

​
What you’ll learn

  • How to enable Amazon Macie for an AWS account and region
  • How to upload sample test files to S3 to validate detection
  • How to create a one-time sensitive data discovery job
  • How to select managed or custom data identifiers
  • How to review findings and integrate Macie with AWS services for automation

​
Prerequisites

  • An AWS account with permissions to enable Macie and access S3 (Macie: macie2:*, S3: s3:* or appropriate scoped permissions).
  • An S3 bucket to hold test objects (example used here: macie-kodekloud).

​
1. Enable Macie and prepare test data

  1. Open the AWS Console and search for “Macie”. Select Get started and follow the prompts to enable Amazon Macie for your account and region.
  2. Prepare or download test files that contain data Macie can detect. For this demo we use three files:
Sample file summaries: addresses.txt:
credit-cards.txt:
random-text.txt:
  1. Upload these three files to your S3 bucket (e.g., macie-kodekloud).

​
2. Create a sensitive data discovery job

After enabling Macie and uploading the files:
  1. In the Macie console, go to Jobs → Create job.
  2. Select the S3 bucket you uploaded to (for example, macie-kodekloud) and proceed.
A screenshot of the AWS Amazon Macie console showing the "Choose S3 buckets" job creation page with a list/table of S3 buckets. The right pane shows details for the selected bucket "macie-kodekloud" (account ID, region, ARN, creation time, etc.).
Macie shows an estimated cost for the job. Click Next to continue. On the “Refine the scope” step choose:
  • One-time or scheduled scanning (daily/weekly/monthly)
  • Whether to include existing objects
  • Sampling depth (percentage of objects scanned)
For this demo we run a one-time job, include existing objects, and set sampling to 100%.
Screenshot of the Amazon Macie console on the "Refine the scope" step of creating a job. It shows sensitive data discovery options with a scheduled daily job selected, "Include existing objects" checked, and sampling depth set to 100%.
Key job options (quick reference): Click Next to select data identifiers.

​
3. Select managed and custom data identifiers

Macie includes managed data identifiers for many common patterns (credit cards, SSNs, driver’s licenses, addresses across countries). You can choose:
  • Managed identifiers (pre-built) — recommended for standard detections.
  • Custom data identifiers — define regular expressions to detect organization-specific patterns.
  • Allow lists — exclude specific strings or patterns to reduce false positives.
For this demo:
  • We selected managed identifiers for addresses and credit card numbers only.
  • We did not configure custom identifiers or allow lists.
  • We provided the job name macie-test-job and submitted the job.
A screenshot of the Amazon Macie web console showing the "Enter general settings" page for creating a job, with "macie-test-job" entered as the job name. The left sidebar shows Macie menu items and setup steps, and "Previous" and "Next" buttons appear at the bottom.
Macie starts the analysis after you submit. Job run time depends on number and size of objects.
If you want to retain full discovery outputs or export results programmatically, configure a results repository (an S3 bucket) for sensitive data discovery results in Macie’s settings. Without a repository you will still see findings in the console but may receive a warning about missing a repository.

​
4. Review findings

When the job completes, refresh the Jobs page and open the job to view findings. Findings include severity (High, Medium, Low), the finding type (for example, S3 object — financial), and details about the affected resource (bucket and object key).
A screenshot of the Amazon Macie web console showing the Jobs page with a list of jobs (including "macie-test-job") and a details panel on the right showing the job status as "Complete." A yellow banner at the top warns that a repository for sensitive data discovery results hasn't been configured.
In this demo Macie produced two findings:
  • High severity: credit-cards.txt — Macie detected multiple credit card numbers (S3 object / financial).
  • Medium severity: addresses.txt — Macie detected multiple postal addresses (personal information).
Select an individual finding to see:
  • The bucket and object key that triggered the finding
  • Number of matches and types of identifiers detected
  • Severity, occurrence time, and suggested remediation steps
A screenshot of the Amazon Macie console showing sensitive-data findings for S3 objects, including a High severity result for "credit-cards.txt" and a Medium severity result for "addresses.txt." The right panel shows bucket and object details and a yellow banner warning about configuring a repository.
Recommended immediate actions after reviewing findings:
  • Remove or quarantine sensitive objects from public access.
  • Apply least-privilege bucket policies and IAM roles.
  • Enable server-side encryption (SSE) for sensitive S3 objects.
  • Remediate or redact data when appropriate and retain audit logs.

​
5. Integrations and next steps

Macie findings can be integrated with AWS services to automate response and centralize security data: Consider the following production recommendations:
  • Schedule recurring jobs for continuous monitoring of critical buckets.
  • Use allow lists and custom identifiers to optimize detection and reduce false positives.
  • Configure a results repository to export findings and enable downstream automation.
  • Monitor Macie costs and sampling rates for large buckets to control expenses.

​
Summary

This lesson covered:
  • Enabling Amazon Macie and preparing sample S3 objects for testing
  • Creating a one-time sensitive data discovery job and setting scope/sampling
  • Selecting managed and custom data identifiers, and naming the job (macie-test-job)
  • Reviewing findings and taking remediation steps
  • Integrating Macie with EventBridge, Lambda, Security Hub, SNS, and S3 for automation and retention
If you run Macie in production, prefer scheduled scans, full sampling for critical buckets, comprehensive managed identifiers, allow lists to tune detection, and a configured results repository for exports and auditing.

Watch Video