Question

A financial services company stores millions of documents across hundreds of S3 buckets. Compliance requires the security team to identify which buckets contain personally identifiable information (PII) such as credit card numbers and Social Security numbers, and to receive automated findings when new sensitive data appears. The team also wants to minimize the cost of scanning by avoiding repeated full scans of unchanged objects. Which approach best meets these requirements?

Accepted Answer

Enable Amazon Macie and configure scheduled sensitive data discovery jobs that use managed data identifiers, allowing Macie to automatically evaluate only new and modified objects.

Answer

Write a custom AWS Lambda function triggered by S3 event notifications that uses regular expressions to scan each uploaded object and publishes matches to an SNS topic.

Answer

Enable Amazon GuardDuty S3 protection to detect PII within objects and forward classification results to AWS Security Hub.

Answer

Use AWS Config with a managed rule that inspects S3 object contents for credit card and SSN patterns and reports noncompliant buckets.