Question

A financial services company ingests millions of documents daily into an Amazon S3 data lake. The compliance team is concerned that files containing personally identifiable information (PII) such as national ID numbers and credit card numbers may be uploaded to buckets that are not intended to store sensitive data. They want an automated, managed solution that continuously discovers and classifies sensitive data across S3 and generates findings that can trigger alerts. Which AWS service should the data engineer use to meet this requirement with the least operational overhead?

Accepted Answer

Enable Amazon Macie to run automated sensitive data discovery jobs against the S3 buckets and route findings to EventBridge for alerting.

Answer

Write an AWS Glue ETL job that scans each object with custom regex transforms to detect PII and logs matches to CloudWatch.

Answer

Configure S3 Object Lambda to inspect every uploaded object and reject files that contain PII patterns.

Answer

Use Amazon Comprehend batch analysis jobs invoked by Lambda on every S3 PutObject event to detect entities and store results in DynamoDB.