SYSTEM Cited by 1 source
Amazon Macie¶
What it is¶
Amazon Macie is an AWS-managed sensitive-data discovery and classification service for S3. It uses machine learning and pattern matching to automatically detect personally identifiable information (PII) and other sensitive data in S3 objects.
Key properties¶
- Managed data identifiers: Built-in detection for standard PII (names, addresses, SSNs, credit card numbers, etc.) across dozens of data types.
- Custom data identifiers: Extend detection via customer-defined regex patterns for organization-specific sensitive data (e.g., policy numbers, member IDs). Up to 10,000 per account, maximum 30 per classification job.
- Classification jobs: Targeted scans of specific S3 objects/buckets; can be one-time or recurring. Each job produces structured findings with severity levels.
- API throttle:
CreateClassificationJobis throttled at 0.1 req/s (one job every 10 seconds) — a load-bearing constraint for per-object pipeline designs.
Architectural role¶
In event-driven compliance pipelines, Macie serves as the classification engine — the compute step between event trigger and findings reporting. It is orchestrated by Step Functions (for retry + wait-state polling of asynchronous scan completion) and triggered by EventBridge (for real-time S3 event detection).
The per-object-job vs batch-job design decision is the primary architectural trade-off: - Per-object: real-time detection, higher API overhead, constrained by 0.1 req/s throttle - Batch: cost-efficient, amortizes overhead, but introduces scan latency
Seen in¶
- sources/2026-07-22-aws-automate-custom-pii-detection-at-scale-with-amazon-macie — canonical event-driven PII pipeline with custom identifiers + Step Functions orchestration + three-bucket isolation
Related¶
- systems/aws-s3 — the storage substrate Macie scans
- systems/aws-step-functions — orchestrates the scan lifecycle (create job → wait → poll status → retrieve findings)
- patterns/three-bucket-data-isolation — the data-lineage pattern wrapping Macie scans