Question

A financial services company stores millions of documents in Amazon S3 across dozens of buckets. The compliance team must automatically discover and classify buckets that contain personally identifiable information (PII) such as credit card numbers and Social Security numbers, and receive ongoing alerts when new sensitive data appears. They also want to verify that buckets holding sensitive data are encrypted and not publicly accessible. Which approach best meets these data classification requirements with the least custom development?

Accepted Answer

Enable Amazon Macie for the account, run scheduled sensitive data discovery jobs against the S3 buckets, and review Macie's automated bucket-level findings for public access and encryption status.

Answer

Enable Amazon GuardDuty S3 protection and create EventBridge rules to alert when objects containing PII are uploaded.

Answer

Build a Lambda function triggered on S3 object creation that uses Amazon Comprehend to detect entities and writes classification tags to each object.

Answer

Use AWS Config managed rules to evaluate bucket encryption and public access, and enable S3 server access logging to identify sensitive data.