Several buckets must be scanned periodically for accidentally stored PII.
Notify data owners and correct unnecessary exposure.
Which protection approach is most appropriate?
Use Amazon Macie sensitive-data discovery to inspect object content and route findings to owners.
Detailed explanation
Retention rules do not locate or classify PII.
Retention rules do not locate or classify PII.
Names do not reveal sensitive values in object content.
Names do not reveal sensitive values in object content.
API history does not inspect object contents.
API history does not inspect object contents.
Macie analyzes S3 content and identifies managed data identifiers.
Macie analyzes S3 content and identifies managed data identifiers.
Check official documentation
Compare the following points with the official documentation.
Amazon Macie sensitive data discovery、managed data identifiers、S3の公式説明を確認する。
What to confirm
内容検査とファイル名・監査ログの検索の違いを説明できる。
Key points
- Amazon Macie
- Sensitive-data discovery
- PII
- Classification
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Discovery versus protection
A finding leads to masking, deletion, or permission changes; discovery alone does not remediate.
Result privacy
Protect scan results and logs because they may contain sensitive locations or samples.