Question

A healthcare company runs Amazon Macie to discover sensitive data in Amazon S3. Macie reliably detects standard PII and PHI such as names, US Social Security numbers, and credit card numbers. However, the company also stores an internal patient identifier that follows a proprietary format (three uppercase letters, a hyphen, then eight digits). Compliance requires that files containing this proprietary identifier be flagged as sensitive during discovery jobs. What should the security engineer do to meet this requirement with the least ongoing operational overhead?

Accepted Answer

Create a Macie custom data identifier using a regular expression that matches the proprietary format and include it in the sensitive data discovery job.

Answer

Enable additional Macie managed data identifiers and request AWS Support to add the proprietary pattern to the managed identifier set.

Answer

Write a Lambda function triggered by S3 events that scans object contents with a regex and tags matching objects, replacing Macie for this data type.

Answer

Configure an allow list in Macie containing the proprietary identifier format so Macie treats matching values as sensitive.