[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cheat-sheet---en":3,"domain-info---en":3,"topic-info----en":3,"next-aws-certified-cloudops-engineer-associate-security-and-compliance-multi-account-governance-aws-config-and-conformance-packs-en":4,"prev-aws-certified-cloudops-engineer-associate-security-and-compliance-multi-account-governance-aws-config-and-conformance-packs-en":919,"lesson-aws-certified-cloudops-engineer-associate-security-and-compliance-multi-account-governance-aws-config-and-conformance-packs-en":932},null,{"locked":5,"reason":3,"meta":6,"item":19},false,{"title":7,"description":8,"isFree":9,"estimatedMinutes":10,"difficulty":11,"learningObjectives":12},"Data Classification and Amazon Macie","How to build a data classification scheme that survives contact with a real S3 estate: tiers with handling rules attached, tags as the enforcement handle, and Amazon Macie to find the sensitive data your tags did not declare.",true,24,"intermediate",[13,14,15,16,17,18],"Explain what a data classification scheme is and why over-classification is a failure, not a safe default","Map the 5 steps of the classification process to the AWS services that support each one","Use tags as the control handle that connects a classification tier to real permissions","Distinguish Macie policy findings from sensitive data findings and know what triggers each","Choose between automated sensitive data discovery and a sensitive data discovery job for a stated requirement","Configure Macie across an organization, accounting for its Regional behavior and delegated administrator rules",{"id":20,"title":7,"body":21,"description":8,"difficulty":11,"estimatedMinutes":10,"extension":826,"infographics":827,"isFree":9,"learningObjectives":845,"meta":846,"navigation":9,"path":847,"quiz":848,"seo":916,"stem":917,"__hash__":918},"courses/courses/aws-certified-cloudops-engineer-associate/en/domains/04-security-and-compliance/03-data-protection/01-data-classification-and-macie.md",{"type":22,"value":23,"toc":815},"minimark",[24,28,31,39,44,47,114,117,120,124,127,161,164,168,191,194,396,399,402,425,435,439,442,448,522,529,532,536,539,545,551,556,563,567,570,590,593,600,664,667,671,674,681,688,691,709,713,724,727,753,756,760,808,811],[25,26,27],"p",{},"Your organization has 3,200 S3 buckets. Someone in compliance asks a reasonable question: which of them hold customer personal data? The honest answer, in most accounts, is that nobody knows.",[25,29,30],{},"That gap is not just an audit problem. Every control you might apply has a cost. Encrypting with a customer managed key, enabling object-level CloudTrail data events, restricting cross-account sharing, pinning data to approved Regions: apply all of it everywhere and the bill and the friction become unbearable. Apply none of it and one bucket eventually ends the company's week.",[25,32,33,34,38],{},"Data classification is how you escape that trap. Exam skill 4.2.1 asks you to implement ",[35,36,37],"strong",{},"and enforce"," a classification scheme, and those are 2 different jobs. Implementing it is defining tiers and labeling data. Enforcing it means the label actually changes what AWS permits.",[40,41,43],"h2",{"id":42},"a-tier-is-a-set-of-handling-rules-not-a-sticker","A tier is a set of handling rules, not a sticker",[25,45,46],{},"A classification scheme is a small number of levels, each bound to a baseline of controls. A common shape looks like this:",[48,49,50,66],"table",{},[51,52,53],"thead",{},[54,55,56,60,63],"tr",{},[57,58,59],"th",{},"Tier",[57,61,62],{},"Example data",[57,64,65],{},"Handling baseline",[67,68,69,81,92,103],"tbody",{},[54,70,71,75,78],{},[72,73,74],"td",{},"Public",[72,76,77],{},"Marketing assets, published docs",[72,79,80],{},"Default encryption, no access restrictions beyond integrity",[54,82,83,86,89],{},[72,84,85],{},"Internal",[72,87,88],{},"Runbooks, non-sensitive telemetry",[72,90,91],{},"Account-scoped access, SSE-S3, standard retention",[54,93,94,97,100],{},[72,95,96],{},"Confidential",[72,98,99],{},"Customer records, contracts",[72,101,102],{},"Customer managed KMS key, no cross-account sharing, data events logged",[54,104,105,108,111],{},[72,106,107],{},"Restricted",[72,109,110],{},"Payment data, health records",[72,112,113],{},"Dedicated key with a narrow key policy, Region pinning, approved-list access only",[25,115,116],{},"The tier names matter less than the second column and the third. A label with no handling rules attached to it is decoration. A handling rule with no label to attach to has nothing to apply to.",[25,118,119],{},"Here is where teams predictably go wrong. It is tempting to classify everything at the highest tier on the theory that too much protection is never harmful. AWS states the opposite plainly: over-classification incurs unwarranted expense through costly controls, disrupts business operations, and diverts attention away from the datasets that genuinely need it. Standards bodies including ISO and NIST recommend tiered schemes for exactly this reason and advise against practices that treat all data equally. If your scheme puts 90% of the estate in the top tier, the scheme has failed even though every dataset is \"protected\".",[40,121,123],{"id":122},"the-5-steps-and-where-aws-services-attach","The 5 steps, and where AWS services attach",[25,125,126],{},"AWS describes classification as a repeatable process rather than a one-time project. Each step has a service that carries it:",[128,129,130,137,143,149,155],"ol",{},[131,132,133,136],"li",{},[35,134,135],{},"Establish a data catalog."," Inventory the data types you hold, how they are used, and which are governed by a regulation. AWS Glue Data Catalog stores and shares that metadata with schema change tracking.",[131,138,139,142],{},[35,140,141],{},"Assess business criticality and impact."," For each data type, what happens to the business if it is disclosed, altered, or lost? This is the step that decides the tier, and it is not a technical step.",[131,144,145,148],{},[35,146,147],{},"Label the information."," Attach the tier to the actual resources. On AWS this is tagging, and it is covered next.",[131,150,151,154],{},[35,152,153],{},"Handle assets according to the tier."," The controls in that third column become real policies, keys, and settings.",[131,156,157,160],{},[35,158,159],{},"Monitor continuously."," Verify that labels still match reality and that handling is still applied. This is where Macie and AWS Config live.",[25,162,163],{},"Step 3 and step 5 are the pair that most schemes get wrong. Labeling is a declaration made by whoever created the resource. Monitoring is verification of that declaration against the bytes actually stored. A scheme with labeling and no verification is a scheme built on hope.",[40,165,167],{"id":166},"tags-are-the-handle-the-scheme-grabs","Tags are the handle the scheme grabs",[25,169,170,171,175,176,179,180,179,183,186,187,190],{},"On AWS the practical label is a tag, and a single tag key used consistently is worth more than an elaborate taxonomy nobody applies. Something like ",[172,173,174],"code",{},"DataClassification"," with values ",[172,177,178],{},"public",", ",[172,181,182],{},"internal",[172,184,185],{},"confidential",", and ",[172,188,189],{},"restricted",".",[25,192,193],{},"The reason to standardize on one key is that the tag becomes a policy condition. A bucket policy can require a matching principal tag:",[195,196,201],"pre",{"className":197,"code":198,"language":199,"meta":200,"style":200},"language-json shiki shiki-themes material-theme-lighter github-light github-dark","{\n  \"Sid\": \"RestrictedDataNeedsMatchingClearance\",\n  \"Effect\": \"Deny\",\n  \"Principal\": \"*\",\n  \"Action\": \"s3:GetObject\",\n  \"Resource\": \"arn:aws:s3:::example-data-lake/*\",\n  \"Condition\": {\n    \"StringNotEquals\": {\n      \"aws:PrincipalTag/DataClearance\": \"restricted\"\n    }\n  }\n}\n","json","",[172,202,203,212,242,263,284,305,326,341,357,378,384,390],{"__ignoreMap":200},[204,205,208],"span",{"class":206,"line":207},"line",1,[204,209,211],{"class":210},"sP7_E","{\n",[204,213,215,219,223,226,229,233,237,239],{"class":206,"line":214},2,[204,216,218],{"class":217},"s39Yj","  \"",[204,220,222],{"class":221},"sseR_","Sid",[204,224,225],{"class":217},"\"",[204,227,228],{"class":210},":",[204,230,232],{"class":231},"sjJ54"," \"",[204,234,236],{"class":235},"s_sjI","RestrictedDataNeedsMatchingClearance",[204,238,225],{"class":231},[204,240,241],{"class":210},",\n",[204,243,245,247,250,252,254,256,259,261],{"class":206,"line":244},3,[204,246,218],{"class":217},[204,248,249],{"class":221},"Effect",[204,251,225],{"class":217},[204,253,228],{"class":210},[204,255,232],{"class":231},[204,257,258],{"class":235},"Deny",[204,260,225],{"class":231},[204,262,241],{"class":210},[204,264,266,268,271,273,275,277,280,282],{"class":206,"line":265},4,[204,267,218],{"class":217},[204,269,270],{"class":221},"Principal",[204,272,225],{"class":217},[204,274,228],{"class":210},[204,276,232],{"class":231},[204,278,279],{"class":235},"*",[204,281,225],{"class":231},[204,283,241],{"class":210},[204,285,287,289,292,294,296,298,301,303],{"class":206,"line":286},5,[204,288,218],{"class":217},[204,290,291],{"class":221},"Action",[204,293,225],{"class":217},[204,295,228],{"class":210},[204,297,232],{"class":231},[204,299,300],{"class":235},"s3:GetObject",[204,302,225],{"class":231},[204,304,241],{"class":210},[204,306,308,310,313,315,317,319,322,324],{"class":206,"line":307},6,[204,309,218],{"class":217},[204,311,312],{"class":221},"Resource",[204,314,225],{"class":217},[204,316,228],{"class":210},[204,318,232],{"class":231},[204,320,321],{"class":235},"arn:aws:s3:::example-data-lake/*",[204,323,225],{"class":231},[204,325,241],{"class":210},[204,327,329,331,334,336,338],{"class":206,"line":328},7,[204,330,218],{"class":217},[204,332,333],{"class":221},"Condition",[204,335,225],{"class":217},[204,337,228],{"class":210},[204,339,340],{"class":210}," {\n",[204,342,344,347,351,353,355],{"class":206,"line":343},8,[204,345,346],{"class":217},"    \"",[204,348,350],{"class":349},"sZMiF","StringNotEquals",[204,352,225],{"class":217},[204,354,228],{"class":210},[204,356,340],{"class":210},[204,358,360,363,367,369,371,373,375],{"class":206,"line":359},9,[204,361,362],{"class":217},"      \"",[204,364,366],{"class":365},"srdBf","aws:PrincipalTag/DataClearance",[204,368,225],{"class":217},[204,370,228],{"class":210},[204,372,232],{"class":231},[204,374,189],{"class":235},[204,376,377],{"class":231},"\"\n",[204,379,381],{"class":206,"line":380},10,[204,382,383],{"class":210},"    }\n",[204,385,387],{"class":206,"line":386},11,[204,388,389],{"class":210},"  }\n",[204,391,393],{"class":206,"line":392},12,[204,394,395],{"class":210},"}\n",[25,397,398],{},"The same idea works on a KMS key policy, so the confidential-tier key can only be used by principals carrying the matching clearance tag. That is attribute-based access control applied to a classification scheme, and it is the difference between a label and a control.",[25,400,401],{},"Two mechanisms keep the tags honest:",[403,404,405,415],"ul",{},[131,406,407,410,411,414],{},[35,408,409],{},"Prevention."," An SCP with an ",[172,412,413],{},"aws:RequestTag"," condition can deny resource creation when the classification tag is missing, for the services that support tagging at creation time. This stops untagged resources from appearing.",[131,416,417,420,421,424],{},[35,418,419],{},"Detection."," The AWS Config managed rule ",[172,422,423],{},"required-tags"," flags resources missing the tag, and it can carry an automatic remediation action. This catches everything prevention missed.",[25,426,427,428,431,432,434],{},"Neither of them can tell you whether the tag is ",[35,429,430],{},"correct",". A bucket tagged ",[172,433,182],{}," that quietly accumulates passport numbers passes both checks. That specific blind spot is what Macie exists to close.",[40,436,438],{"id":437},"macie-starts-with-an-inventory-not-a-scan","Macie starts with an inventory, not a scan",[25,440,441],{},"Enable Amazon Macie in an account and the first thing it does is generate and maintain an inventory of your S3 general purpose buckets, then evaluate and monitor them for security and access control. No object contents are read yet. This stage is metadata: public access settings, encryption settings, sharing, replication, object counts, and how much of the bucket Macie could analyze if asked.",[25,443,444,445,228],{},"When a bucket's settings change in a way that reduces its security or privacy, Macie writes a ",[35,446,447],{},"policy finding",[48,449,450,460],{},[51,451,452],{},[54,453,454,457],{},[57,455,456],{},"Policy finding type",[57,458,459],{},"What changed",[67,461,462,472,482,492,502,512],{},[54,463,464,469],{},[72,465,466],{},[172,467,468],{},"Policy:IAMUser/S3BlockPublicAccessDisabled",[72,470,471],{},"All bucket-level block public access settings were disabled",[54,473,474,479],{},[72,475,476],{},[172,477,478],{},"Policy:IAMUser/S3BucketPublic",[72,480,481],{},"An ACL or bucket policy now allows anonymous users or all authenticated IAM identities",[54,483,484,489],{},[72,485,486],{},[172,487,488],{},"Policy:IAMUser/S3BucketSharedExternally",[72,490,491],{},"An ACL or bucket policy now shares the bucket with an account outside your organization",[54,493,494,499],{},[72,495,496],{},[172,497,498],{},"Policy:IAMUser/S3BucketSharedWithCloudFront",[72,500,501],{},"The bucket policy now shares the bucket with a CloudFront OAI or OAC",[54,503,504,509],{},[72,505,506],{},[172,507,508],{},"Policy:IAMUser/S3BucketReplicatedExternally",[72,510,511],{},"Replication now sends objects to a bucket in an external account",[54,513,514,519],{},[72,515,516],{},[172,517,518],{},"Policy:IAMUser/S3BucketEncryptionDisabled",[72,520,521],{},"Default encryption settings were reset to base S3 behavior",[25,523,524,525,528],{},"One property of policy findings catches people out constantly, so name it before it bites you: ",[35,526,527],{},"Macie generates a policy finding only if the change occurs after you enable Macie for the account."," A bucket whose block public access settings were already disabled when you turned Macie on, and which stayed that way, produces no finding at all. Macie is watching for changes, not auditing a baseline. To see the pre-existing state you read the bucket inventory and its public access breakdown, which is why the inventory is a first-class feature and not a side effect.",[25,530,531],{},"Policy findings are stored for 90 days. If a policy finding recurs, Macie updates the existing finding and increments the occurrence count rather than creating a new one.",[40,533,535],{"id":534},"two-ways-to-look-inside-the-objects","Two ways to look inside the objects",[25,537,538],{},"Reading object contents is a separate, billed activity, and Macie gives you 2 methods with genuinely different jobs.",[25,540,541,544],{},[35,542,543],{},"Automated sensitive data discovery"," is the breadth option. Macie continually evaluates your bucket inventory, uses sampling to pick representative objects, and analyzes them, one cycle per day. By default it covers every S3 general purpose bucket, and for a Macie administrator that includes buckets owned by member accounts. You narrow it by excluding buckets, which is worth doing for buckets that hold nothing but logs. By default it uses the set of managed data identifiers AWS recommends for automated discovery, and you can swap in specific managed identifiers, your own custom identifiers, or both. The output is sensitive data findings, sensitivity scores per bucket, and an interactive heat map of the estate.",[25,546,547,550],{},[35,548,549],{},"Sensitive data discovery jobs"," are the depth option. You define the buckets, the sampling depth, and criteria drawn from object properties, then run the job once for an on-demand assessment or on a recurring schedule.",[552,553],"infographic",{"alt":554,"slug":555},"A side-by-side comparison of Macie automated sensitive data discovery and sensitive data discovery jobs across scope, cadence, depth, output, and free trial coverage.","macie-discovery-modes",[25,557,558,559,562],{},"The cost boundary is worth memorizing because it shapes the answer to scenario questions. When you first enable Macie, the account is enrolled in a 30-day free trial covering bucket evaluation and, depending on account settings, automated sensitive data discovery. ",[35,560,561],{},"Discovery jobs are not included in the free trial."," If a question mentions a team that enabled Macie, saw no charges, then got a surprise bill, a discovery job is the usual culprit.",[40,564,566],{"id":565},"what-macie-looks-for-and-what-it-ignores","What Macie looks for, and what it ignores",[25,568,569],{},"Three components decide the detection surface:",[403,571,572,578,584],{},[131,573,574,577],{},[35,575,576],{},"Managed data identifiers"," are AWS's built-in criteria, using machine learning and pattern matching. They cover a large and growing list of sensitive data types across many countries and regions: multiple kinds of PII, financial information, and credentials data.",[131,579,580,583],{},[35,581,582],{},"Custom data identifiers"," are yours. A regular expression that defines a text pattern, optionally refined with character sequences and a proximity rule. This is how you detect proprietary identifiers, internal codenames, or an in-house account number format.",[131,585,586,589],{},[35,587,588],{},"Allow lists"," define text and text patterns Macie should ignore. The canonical use is your own organization's public phone numbers and named representatives, or test fixture data that trips PII detectors every single run.",[25,591,592],{},"Allow lists are the tuning knob people forget exists. If a finding type fires repeatedly on data that is deliberately public, the fix is an allow list, not suppression rules layered on top of a noisy detector.",[25,594,595,596,599],{},"When Macie does find something, it writes a ",[35,597,598],{},"sensitive data finding"," naming the category:",[48,601,602,612],{},[51,603,604],{},[54,605,606,609],{},[57,607,608],{},"Sensitive data finding type",[57,610,611],{},"Contents",[67,613,614,624,634,644,654],{},[54,615,616,621],{},[72,617,618],{},[172,619,620],{},"SensitiveData:S3Object/Personal",[72,622,623],{},"PII such as passport or driver's license numbers, or PHI such as health insurance numbers",[54,625,626,631],{},[72,627,628],{},[172,629,630],{},"SensitiveData:S3Object/Financial",[72,632,633],{},"Bank account numbers, credit card numbers",[54,635,636,641],{},[72,637,638],{},[172,639,640],{},"SensitiveData:S3Object/Credentials",[72,642,643],{},"AWS secret access keys, private keys",[54,645,646,651],{},[72,647,648],{},[172,649,650],{},"SensitiveData:S3Object/CustomIdentifier",[72,652,653],{},"Text matching one or more of your custom data identifiers",[54,655,656,661],{},[72,657,658],{},[172,659,660],{},"SensitiveData:S3Object/Multiple",[72,662,663],{},"More than one of the above categories in the same object",[25,665,666],{},"Unlike policy findings, every sensitive data finding is treated as new and unique, even for the same object across runs. They are also stored for 90 days, which is a retention ceiling you should plan around: if the evidence needs to outlive 90 days, export it through EventBridge or Security Hub CSPM into storage you control.",[40,668,670],{"id":669},"macie-across-an-organization","Macie across an organization",[25,672,673],{},"Macie integrates with AWS Organizations, and the rules are specific enough to be exam material.",[25,675,676,677,680],{},"The Organizations management account designates a ",[35,678,679],{},"delegated Macie administrator",", and only the management account can make, change, or remove that designation. An organization has exactly one Macie administrator, and an account cannot be an administrator and a member at the same time.",[25,682,683,684,687],{},"Then the property that trips up multi-Region setups: ",[35,685,686],{},"Macie is a Regional service, but AWS Organizations is global."," The administrator designation is per Region. If the management account designates an administrator in us-east-1, that administrator can manage member accounts only in us-east-1. Covering 4 Regions means signing in to each one and designating the administrator 4 times. The designated account must be the same in every Region, but the designation itself is repeated.",[25,689,690],{},"Three more rules worth carrying:",[403,692,693,699,702],{},[131,694,695,696,190],{},"A Macie administrator can be associated with ",[35,697,698],{},"no more than 10,000 member accounts in each Region",[131,700,701],{},"The administrator cannot enable Macie for the Organizations management account. If you want the management account as a member, a user in that account has to enable Macie there first.",[131,703,704,705,708],{},"A member account ",[35,706,707],{},"cannot disassociate itself",". Only the administrator can remove it, and removal leaves Macie enabled in the account as a standalone account rather than turning it off.",[40,710,712],{"id":711},"closing-the-loop-from-finding-to-control","Closing the loop from finding to control",[25,714,715,716,719,720,723],{},"A finding that nobody acts on is a slower version of not looking. Macie publishes findings to ",[35,717,718],{},"Amazon EventBridge"," as events, which routes them to targets such as Lambda functions and SNS topics for near real time processing. You can also configure Macie to publish findings to ",[35,721,722],{},"AWS Security Hub CSPM",", which aggregates them alongside findings from GuardDuty, Inspector, and the rest, and supports cross-Region aggregation into a single Region.",[25,725,726],{},"The enforcement pattern that satisfies skill 4.2.1 looks like this end to end:",[128,728,729,738,741,747],{},[131,730,731,732,734,735,190],{},"Macie's automated discovery finds ",[172,733,630],{}," in a bucket tagged ",[172,736,737],{},"DataClassification=internal",[131,739,740],{},"The finding lands on EventBridge, matched by a rule filtering on the finding type and severity.",[131,742,743,744,746],{},"A Lambda target re-tags the bucket to ",[172,745,185],{}," and opens a ticket naming the owner from the bucket's owner tag.",[131,748,749,750,752],{},"Because the bucket policy and KMS key policy are already keyed to ",[172,751,174],{},", the tier's handling rules take effect the moment the tag changes.",[25,754,755],{},"Step 4 is the whole point. If the tag is not wired to anything, the automation just renamed a problem.",[40,757,759],{"id":758},"exam-tips","Exam tips",[403,761,762,768,771,778,785,792,795,802,805],{},[131,763,764,765,767],{},"Skill 4.2.1 says implement ",[35,766,37],{},". An answer that only detects and reports is incomplete when another option connects the label to a permission.",[131,769,770],{},"Over-classification is a wrong answer, not a cautious one. Watch for options proposing the strictest control for all data.",[131,772,773,774,777],{},"Macie analyzes ",[35,775,776],{},"Amazon S3 general purpose buckets",". If a question involves RDS, EBS, or DynamoDB content, Macie is not the answer.",[131,779,780,781,784],{},"Policy findings only fire for changes made ",[35,782,783],{},"after"," Macie is enabled. Pre-existing weaknesses show in the bucket inventory, not as findings.",[131,786,787,788,791],{},"Automated sensitive data discovery = broad, continuous, sampled, all buckets by default, included in the 30-day free trial. Discovery job = targeted, on demand or scheduled, depth you configure, ",[35,789,790],{},"not"," in the free trial.",[131,793,794],{},"Custom data identifier = a regex for something AWS does not know about. Allow list = text to ignore. They point in opposite directions.",[131,796,797,798,801],{},"Both finding categories are stored for ",[35,799,800],{},"90 days",". Policy findings update in place on recurrence; sensitive data findings are always new.",[131,803,804],{},"Macie is Regional. Delegated administrator designation, member associations, and the 10,000 member quota are all per Region, and only the Organizations management account can designate the administrator.",[131,806,807],{},"Findings reach automation through EventBridge, and reach a consolidated posture view through Security Hub CSPM.",[25,809,810],{},"The one thing to carry forward: classification is what makes every later control in this topic affordable. Encryption, key policies, certificate scope, and secret rotation all get cheaper and sharper when they apply to the right subset instead of to everything. The next lesson takes the confidential tier's handling rule literally and builds it with KMS.",[812,813,814],"style",{},"html pre.shiki code .sP7_E, html code.shiki .sP7_E{--shiki-light:#39ADB5;--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .s39Yj, html code.shiki .s39Yj{--shiki-light:#39ADB5;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sseR_, html code.shiki .sseR_{--shiki-light:#9C3EDA;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sjJ54, html code.shiki .sjJ54{--shiki-light:#39ADB5;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .s_sjI, html code.shiki .s_sjI{--shiki-light:#91B859;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sZMiF, html code.shiki .sZMiF{--shiki-light:#E2931D;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .srdBf, html code.shiki .srdBf{--shiki-light:#F76D47;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":200,"searchDepth":244,"depth":244,"links":816},[817,818,819,820,821,822,823,824,825],{"id":42,"depth":214,"text":43},{"id":122,"depth":214,"text":123},{"id":166,"depth":214,"text":167},{"id":437,"depth":214,"text":438},{"id":534,"depth":214,"text":535},{"id":565,"depth":214,"text":566},{"id":669,"depth":214,"text":670},{"id":711,"depth":214,"text":712},{"id":758,"depth":214,"text":759},"md",[828],{"slug":555,"concept":829,"style":830,"aspectRatio":831,"labels":832},"A two-panel side-by-side comparison of Amazon Macie's two sensitive data discovery methods. The left panel is automated sensitive data discovery, the right panel is a sensitive data discovery job. Each panel carries the same 5 rows in the same order so the eye can scan across: scope, cadence, depth, output, free trial. A single takeaway strip runs along the bottom stating the decision rule. Emphasis goes on the scope and depth rows, which are where the two methods actually diverge.","comparison","16:9",[543,833,834,835,836,837,838,839,840,841,842,843,844],"Sensitive data discovery job","Scope: every S3 general purpose bucket by default","Scope: only the buckets you name","Cadence: continuous, one analysis cycle per day","Cadence: once on demand, or on a schedule you set","Depth: a sample of representative objects per bucket","Depth: the sampling depth you configure, up to every object","Output: findings, sensitivity scores, and the bucket heat map","Output: findings and a discovery result per object analyzed","Free trial: included for 30 days","Free trial: not included, billed from the first run","Use automated discovery to find where to look, then run a job to look properly",[13,14,15,16,17,18],{},"/courses/aws-certified-cloudops-engineer-associate/en/domains/04-security-and-compliance/03-data-protection/01-data-classification-and-macie",{"passingScore":849,"questions":850},70,[851,860,868,876,886,894,900,908],{"question":852,"type":853,"options":854,"correctAnswer":856,"explanation":859},"A team proposes labeling every dataset in the company Restricted so nothing is ever under-protected. What is the strongest argument against this?","single",[855,856,857,858],"AWS quotas limit how many resources can carry the same tag value","Over-classification pays for expensive controls on low-risk data and buries the data that genuinely needs attention","Macie cannot analyze buckets that are tagged Restricted","Classification tiers must be evenly distributed across the estate","Standards bodies recommend tiers precisely so that controls scale with risk, and AWS calls out over-classification as a real cost: unwarranted spend, business friction, and attention pulled away from critical datasets. There is no quota or Macie restriction involved; the failure is economic and operational.",{"question":861,"type":853,"options":862,"correctAnswer":865,"explanation":867},"Macie has been enabled in your account for 3 months. A bucket has had all bucket-level block public access settings disabled since before Macie was enabled, and nothing has changed since. What does Macie report?",[863,864,865,866],"A Policy:IAMUser/S3BlockPublicAccessDisabled finding, regenerated every 90 days","A SensitiveData:S3Object/Multiple finding for every object in the bucket","No policy finding for that setting, because the change predates Macie being enabled","A policy finding only after the next automated sensitive data discovery cycle","Macie generates a policy finding when settings are changed in a way that reduces security, and only if the change happens after Macie is enabled for the account. A setting that was already weak and stayed weak produces no finding, which is why the bucket inventory and its public access breakdown matter as much as the findings list. Sensitive data findings come from analysis of objects, not from bucket settings.",{"question":869,"type":853,"options":870,"correctAnswer":871,"explanation":875},"You need a one-time, exhaustive inspection of 3 named buckets before a compliance audit next week. Which Macie capability fits?",[871,872,873,874],"A sensitive data discovery job scoped to those buckets","Automated sensitive data discovery with the other buckets excluded","A custom data identifier applied to the account","An allow list containing the 3 bucket names","Discovery jobs are the targeted option: you choose the buckets, the sampling depth, and whether it runs once or on a schedule. Automated discovery samples continually across the whole estate and is tuned for breadth, not for a deep pass on 3 buckets. A custom data identifier defines what to look for, and an allow list defines what to ignore; neither one scopes an analysis to specific buckets.",{"question":877,"type":878,"options":879,"correctAnswers":884,"explanation":885},"Which statements about Macie in an AWS Organizations setup are correct? (Choose 2.)","multiple",[880,881,882,883],"Only the Organizations management account can designate the delegated Macie administrator","Designating the Macie administrator once covers every Region the organization uses","A member account can remove itself from the Macie administrator at any time","The Macie administrator can be associated with up to 10,000 member accounts in each Region",[880,883],"Macie is a Regional service, so the management account must designate the same administrator account separately in every Region where the organization uses Macie. The 10,000 member limit is also per Region. A member account cannot disassociate itself; only the administrator can remove it.",{"question":887,"type":853,"options":888,"correctAnswer":891,"explanation":893},"Your organization needs Macie to flag internal project codenames that appear in S3 objects. Which feature does that?",[889,890,891,892],"A managed data identifier","An allow list","A custom data identifier","A policy finding filter","A custom data identifier is a regular expression you define, optionally refined with keywords and a proximity rule, for data types AWS could not anticipate such as proprietary identifiers or codenames. Managed data identifiers cover the built-in catalog of PII, financial, and credentials data. An allow list does the opposite: it names text you want Macie to ignore.",{"question":895,"type":853,"options":896,"correctAnswer":898,"explanation":899},"True or False: enabling Macie automatically analyzes the objects in every bucket for sensitive data, with no further configuration.",[897,898],"True","False","Enabling Macie always produces the S3 bucket inventory and starts evaluating buckets for security and access control, which is a metadata activity. Analyzing object contents happens only through automated sensitive data discovery or a discovery job, and automated discovery is configured by the Macie administrator or a standalone account. The distinction matters for cost as well: the 30-day free trial covers bucket evaluation and automated discovery, not discovery jobs.",{"question":901,"type":853,"options":902,"correctAnswer":905,"explanation":907},"A finding reports credit card numbers in a bucket that your team tagged DataClassification=internal. Which response best matches the goal of skill 4.2.1, enforcing a classification scheme?",[903,904,905,906],"Suppress the finding, since the bucket was already classified","Add a custom data identifier so the same pattern is not reported again","Route the finding through EventBridge to a workflow that re-tags the bucket and applies the confidential-tier controls","Disable automated sensitive data discovery for that bucket to reduce noise","A classification scheme is enforced when the discovered reality changes the applied controls, and Macie publishes findings to EventBridge as events so a Lambda function or SNS topic can act on them in near real time. Suppressing or excluding the bucket hides the mismatch instead of closing it, and a custom data identifier would only broaden detection, not respond to it.",{"question":909,"type":853,"options":910,"correctAnswer":914,"explanation":915},"Which pairing of classification step and AWS service is correct?",[911,912,913,914],"Continuous monitoring paired with AWS Glue Data Catalog","Establishing a data catalog paired with AWS Config conformance packs","Handling of assets paired with Amazon Macie discovery jobs","Handling of assets paired with KMS key policies scoped by resource tag","Handling means the controls a tier actually receives, and a KMS key policy or bucket policy keyed to the classification tag is exactly how that handling becomes enforceable. The data catalog step is where AWS Glue Data Catalog fits, and continuous monitoring is where Config and Macie belong. Discovery jobs support labeling and monitoring, not the definition of handling rules.",{"title":7,"description":8},"courses/aws-certified-cloudops-engineer-associate/en/domains/04-security-and-compliance/03-data-protection/01-data-classification-and-macie","Am1Ce9f9TeEaSkSx5ls9j1OqK09KUlB442eStq3GrmE",{"locked":9,"reason":920,"meta":921,"item":3},"paywall",{"title":922,"description":923,"isFree":5,"estimatedMinutes":924,"difficulty":11,"learningObjectives":925},"Trusted Advisor and Security Check Remediation","How to read Trusted Advisor security findings and act on them: what each check actually detects, which checks a Basic Support account gets, the refresh rules, and how to automate the response with EventBridge, Systems Manager, and organizational view.",22,[926,927,928,929,930,931],"Describe the 6 Trusted Advisor check categories and what the 4 status colors mean","Identify which checks are available on Basic Support and which require a paid support plan","Interpret the alert criteria for the main security checks and choose the correct remediation","Explain the refresh behavior of Trusted Advisor checks and when a manual refresh is possible","Automate a response to a check status change using EventBridge and Systems Manager Automation","Compare organizational view with Trusted Advisor Priority and state the prerequisites for each",{"locked":9,"reason":920,"meta":933,"item":3},{"title":934,"description":935,"isFree":5,"estimatedMinutes":936,"difficulty":937,"learningObjectives":938},"AWS Config and Conformance Packs","How to turn a compliance requirement into a continuously evaluated control: the configuration recorder and configuration items, rule triggers and evaluation modes, automatic remediation through Systems Manager, and packaging rules for an entire organization.",30,"advanced",[939,940,941,942,943,944,945],"Explain what a configuration item is and how the configuration recorder produces one","Distinguish AWS Config from CloudTrail for a given evidence requirement","Select the correct rule trigger type and evaluation mode for a stated requirement","Interpret the 4 rule evaluation results, including NOT_APPLICABLE","Configure automatic remediation with a Systems Manager Automation document and describe its retry behavior","Deploy a conformance pack to an account or an organization and read its compliance score","Choose between an aggregator, an organization rule, and an organization conformance pack for a multi-account requirement"]