c2.19 Discover sensitive data
Define which data is most sensitive (your "crown jewels") and where it should live, then use Amazon Macie to find where that data actually is — often in places you did not expect.
Implementation guidance
Know your crown jewels, then find them
Start by defining which data is most sensitive to the organization and where it is supposed to live. In practice, sensitive data ends up in more places than expected, so you need a way to discover it.
Scan with Amazon Macie
Amazon Macie performs sensitive data discovery across your Amazon S3 data using AWS-managed data identifiers (credit cards, ID numbers, access keys, contact details, and other PII). Supplement them with custom data identifiers (regular expressions) for data specific to your company, industry, or region. Macie also reports the security posture of your buckets (public access, encryption, sharing).
Databases and other stores
For sensitive data in databases, partner solutions on the AWS Marketplace can help. Feed what you discover back into your data-classification and compliance processes.
Enable and scan with the CLI
Turn Macie on, then run a one-time sensitive-data discovery job over specific buckets:
aws macie2 enable-macie
aws macie2 create-classification-job \
--job-type ONE_TIME \
--name discover-sensitive-data \
--s3-job-definition '{"bucketDefinitions":[{"accountId":"111122223333","buckets":["my-bucket"]}]}'How to validate
- Have you defined which data is most sensitive and where it should live?
- Do you use Amazon Macie (or similar) to discover sensitive data across your storage?
- Do you cover custom, organization-specific data patterns, not just the managed identifiers?
Threats addressed
- Sensitive data in unexpected or unmonitored locations is easy to expose accidentally (a public bucket, an unencrypted copy) and hard to protect when you do not know it is there.
AWS services
Amazon Macie 
Amazon S3 Pricing
Amazon Macie includes a 30-day free trial for bucket and access assessment (data-security posture) and 1 GB per month of free sensitive-data discovery in the free tier. If you only enable the service without running discovery jobs beyond that, you are not charged during the trial. See Amazon Macie pricing.