Question

A financial services company stores customer records in Amazon S3. The security team wants to be automatically alerted when an S3 bucket contains data such as credit card numbers or national ID numbers, and separately wants to detect anomalous API activity that could indicate credentials have been stolen. Which combination of managed services should the architect recommend to meet BOTH requirements with the least operational overhead?

Accepted Answer

Use Amazon Macie to discover and classify sensitive data in S3, and Amazon GuardDuty to detect anomalous API and account activity.

Answer

Use AWS Config rules to inspect S3 object contents, and AWS CloudTrail Insights to classify sensitive data.

Answer

Use Amazon Inspector to scan S3 objects for PII, and Amazon Macie to detect anomalous API calls.

Answer

Use Amazon GuardDuty to classify sensitive S3 data, and AWS WAF to detect stolen-credential API activity.