Question

A financial services company uses Amazon Macie to scan S3 buckets for sensitive data. When Macie discovers objects containing personally identifiable information (PII) in buckets that are not approved for PII storage, the security team wants an automated response that blocks further access to the specific offending objects within minutes, records the action for audit, and notifies the security channel — all without disabling access to the entire bucket or blocking legitimate objects. Which approach BEST meets these requirements?

Accepted Answer

Create an EventBridge rule matching Macie 'SensitiveData' findings that targets a Lambda function which applies a restrictive object-level ACL/S3 Object Lock or tags the object and updates a deny statement scoped to those object keys, writes the action to a DynamoDB audit table, and publishes to an SNS topic subscribed by the security channel.

Answer

Configure Macie to publish findings to Security Hub, then enable an S3 bucket policy that denies all GetObject requests on the entire bucket whenever any finding exists.

Answer

Schedule an EventBridge rule every 5 minutes to invoke a Lambda that lists all Macie findings via the API and deletes any object flagged as containing PII, logging deletions to CloudWatch Logs.

Answer

Enable Macie automated sensitive data discovery and rely on its built-in remediation to move flagged objects to a quarantine bucket and notify the team through Macie's native alerting.