Question

A financial services company must implement a data classification strategy for a data lake in Amazon S3 containing millions of objects. Objects classified as 'Restricted' (containing PII) must be encrypted with a dedicated customer managed KMS key and retained for 7 years, while 'Internal' objects can use SSE-S3 and transition to cheaper storage after 90 days. The security team wants classification to drive these downstream controls automatically as new objects arrive, with minimal ongoing manual effort. Which approach best meets these requirements?

Accepted Answer

Use Amazon Macie to discover and classify sensitive data, apply object tags based on findings, and use S3 Lifecycle rules and separate buckets with tag-based bucket policies to enforce KMS encryption and tiering per classification.

Answer

Enable S3 default encryption with a single customer managed KMS key on the bucket and configure one Lifecycle rule to transition all objects to S3 Glacier Deep Archive after 90 days.

Answer

Manually review a sample of objects each quarter, tag them by hand, and rely on IAM policies to control which analysts can access Restricted data.

Answer

Turn on S3 Storage Lens with advanced metrics to identify PII and automatically re-encrypt matching objects with the dedicated KMS key.