Question

A healthcare company stores millions of documents in Amazon S3 buckets across several accounts. Compliance auditors have asked the security team to automatically discover and classify buckets that contain personally identifiable information (PII) such as patient names and social security numbers, and to receive ongoing alerts when new sensitive data appears. Which AWS service should the team use to meet this requirement with the least operational effort?

Accepted Answer

Enable Amazon Macie to run automated sensitive data discovery jobs against the S3 buckets and generate findings for PII.

Answer

Enable Amazon GuardDuty to continuously monitor the S3 buckets and classify objects containing PII.

Answer

Configure AWS Config rules to scan object contents in S3 and flag buckets that contain sensitive data.

Answer

Use AWS Lambda functions triggered by S3 events to parse each object with custom regex patterns and store classification results.