Skip to main content
In this lesson we will learn about AWS Macie. Before we cover Macie, it’s important to understand the concept of personally identifiable information (PII). PII (personally identifiable information) is any personal data that can be used to uniquely identify an individual or that could be exploited to impersonate them. Examples include:
  • Full name
  • Date of birth
  • Email address
  • Phone number
  • Home address
  • Passport number, Social Security number, or other government-issued identifiers
Amazon Macie is a security and privacy service that uses machine learning and pattern matching to discover, classify, and help protect sensitive data stored in Amazon S3. Macie can identify PII and other sensitive information—such as credit card numbers, passport numbers, and driver’s license numbers—across objects in S3 buckets. When Macie detects sensitive data, it generates findings so you can investigate and remediate the issue. Macie findings are easy to integrate into event-driven workflows. For example, you can route Macie findings to Amazon EventBridge and trigger a Lambda function that sends an email or otherwise notifies your data protection team. Macie findings can also be consumed by other AWS services and third-party tools to drive automated responses or ticketing workflows.
A simple flow diagram showing AWS Macie scanning an S3 bucket for sensitive/PII data. When Macie finds data, EventBridge triggers a Lambda function which sends a notification (email) to the data protection team.
How Macie inspects data
  • Macie analyzes both object metadata and object content in S3 to identify sensitive information.
  • It uses managed data identifiers (pre-built patterns for common sensitive types such as credit cards and SSNs) plus custom data identifiers you can create for organization-specific patterns.
  • When a finding is produced, Macie classifies the severity and provides context so you can prioritize investigations.
Common actions after a finding
  • Route the finding to EventBridge to trigger Lambda, Step Functions, or other targets.
  • Send notifications via Amazon SNS or integrate with ticketing systems.
  • Aggregate and analyze findings using the Macie console dashboards or export them to SIEM/SOAR tools for advanced analysis.
How Macie works — high level
  1. Discovery: Macie scans configured S3 buckets and indexes objects and metadata.
  2. Classification: Objects are evaluated against managed and custom identifiers to detect sensitive data.
  3. Finding generation: When sensitive data is detected, Macie generates findings with severity, sample data, and location.
  4. Action: Findings are routed to EventBridge, stored, or forwarded to downstream systems for remediation or reporting.
Use cases
  • Discover and inventory locations of PII and sensitive data across S3.
  • Continuous monitoring for accidental data exposures in object storage.
  • Automated remediation pipelines (e.g., quarantine objects, block access, notify owners).
  • Compliance reporting and data governance.
Benefits of using Macie Getting started — quick checklist
  • Enable Amazon Macie in the AWS account and choose which S3 buckets to scope.
  • Review and tune managed data identifiers for your environment.
  • Create custom data identifiers for organization-specific patterns.
  • Configure EventBridge rules to catch Macie findings and route to automation targets (Lambda, Step Functions, SNS).
  • Build remediation logic in Lambda or Step Functions (notification, quarantine, policy enforcement).
  • Monitor and refine using Macie dashboards and exported logs to SIEM/SOAR systems.
Macie focuses on discovering and protecting sensitive data stored in Amazon S3. Review the Macie pricing and the scope of S3 scanning before enabling across many buckets to estimate cost and scan coverage.
References and further reading

Watch Video