Skip to content

SYSTEM Cited by 1 source

Amazon Macie

What it is

Amazon Macie is an AWS-managed sensitive-data discovery and classification service for S3. It uses machine learning and pattern matching to automatically detect personally identifiable information (PII) and other sensitive data in S3 objects.

Key properties

  • Managed data identifiers: Built-in detection for standard PII (names, addresses, SSNs, credit card numbers, etc.) across dozens of data types.
  • Custom data identifiers: Extend detection via customer-defined regex patterns for organization-specific sensitive data (e.g., policy numbers, member IDs). Up to 10,000 per account, maximum 30 per classification job.
  • Classification jobs: Targeted scans of specific S3 objects/buckets; can be one-time or recurring. Each job produces structured findings with severity levels.
  • API throttle: CreateClassificationJob is throttled at 0.1 req/s (one job every 10 seconds) — a load-bearing constraint for per-object pipeline designs.

Architectural role

In event-driven compliance pipelines, Macie serves as the classification engine — the compute step between event trigger and findings reporting. It is orchestrated by Step Functions (for retry + wait-state polling of asynchronous scan completion) and triggered by EventBridge (for real-time S3 event detection).

The per-object-job vs batch-job design decision is the primary architectural trade-off: - Per-object: real-time detection, higher API overhead, constrained by 0.1 req/s throttle - Batch: cost-efficient, amortizes overhead, but introduces scan latency

Seen in

Last updated · 590 distilled / 1,788 read