Macie

Amazon Macie is a data security service that uses machine learning and pattern matching to discover and classify sensitive data stored in Amazon S3. It identifies PII, financial data, credentials, and other sensitive content, and assesses S3 bucket access configurations. Findings are in Macie’s proprietary JSON format and are also sent to Security Hub in OCSF format.

Data Sources

Macie analyzes:

• S3 bucket inventory and access configurations (automated)
• S3 object content via classification jobs or automated sensitive data discovery
• Supports all S3 storage classes except Glacier Deep Archive

Read-Only APIs

Severity Scoring

Macie assigns severity (1-3 scale) based on sensitive data type and context, not occurrence count alone:

Key rules:

• Credentials are always High regardless of occurrence count
• Severity increases when multiple sensitive data categories appear in the same S3 object
• Custom data identifiers inherit the severity configured at creation time
• Policy findings (bucket-level) use a separate severity scale based on bucket exposure
• Automated discovery findings aggregate across objects — severity reflects bucket-level risk

Refer to Macie severity scoring documentation (opens in a new tab) for complete per-finding-type breakdown.

Service Notes

No service-specific notes.

Output Sensitivity

Macie finding details (GetFindings) contain:

• S3 bucket names and object keys where sensitive data was detected
• Sensitive data categories and occurrence counts (PII, financial, credentials)
• AWS account IDs and resource ARNs
• Classification job configuration details
• Bucket access permissions and encryption status

Present finding severity/type summary and affected bucket counts first. Offer full finding details on request. Never include actual sensitive data samples in output.