c1.13 Analyze data security posture
The QuickWin around Amazon Macie is only enabling it and viewing periodically the dashboard to ensure that all your S3 buckets are configured properly and there is no misconfiguration that could lead to a security event. Only costs 0.10 USD per bucket per month, can be implemented in a few clic…
Implementation guidance
Actively define where to store your sensitive data
Remember, telling users or developers "don't store your sensitive information here" is not as useful as explicitly telling them where to store each type of sensitive information, that avoids confusion, users or developers might find a worse place to host that data if you do not specify where it's safe.
Verify that sensitive data is not publicly exposed or shared with unknown accounts outside your organization
Activating Amazon Macie you will see how many buckets are open to the world, how many are shared outside your organization, how many of them are encrypted and you will be able to identify which ones need corrections to align with your security policy
The QuickWin around Amazon Macie is only enabling it and viewing periodically the dashboard to ensure that all your S3 buckets are configured properly and there is no misconfiguration that could lead to a security event. Only costs 0.10 USD per bucket per month, can be implemented in a few clicks, and will help you to identify when your data security policies are not properly set up. If you enable Automated Data Sensitivity Discovery you will gain additional insights regarding which kind of data is stored on each bucket and has a free trial that will allow you to estimate the cost.
Amazon Macie Demo
View Demo
Workshops
Solutions from AWS Marketplace
There are solutions for data discovery and classification in AWS Marketplace, such as Data Sunrise and Varonis.
How to validate
- Do you have a data security policy ?
- What mechanisms do you have to make sure it's enforced ?
- Are you using Amazon Macie ? is it enabled on all your accounts ?
- Is Automated Data Discovery turned on ? have you analyzed the findings ?
Threats addressed
- ATT&CK Exfiltration Users may misconfigure Amazon S3 buckets opening them for public access or allowing access from an untrusted account outside your organization.
- ATT&CK Exfiltration An insider threat actor may share a bucket with sensitive information to his personal AWS Account to exfiltrate data. Macie will help you identify these risks.
AWS services
Amazon Macie 
Amazon S3 Pricing
Amazon Macie includes a 30-day free trial for bucket and access assessment (data-security posture) and automatic data sensitivity discovery, plus 1 GB per month of free data discovery in the free tier. If you only enable the service without running discovery jobs beyond that, you are not charged during the trial. See Amazon Macie pricing.