SAA-C03 Practice Question 61: Macie Sensitive Data Discovery
AWS Certified Solutions Architect – Associate (SAA-C03) · Test 7 · question 1 of 10
A healthcare provider has accumulated several thousand S3 buckets across a decade of projects. Ahead of a compliance audit it must produce a report of which buckets hold patient records and other personally identifiable information. Nobody knows what is in most of the older buckets, and the team does not want to write and maintain its own scanning code.
Which service should they use?
Show answer and explanation
Answer:
Macie is the managed service for exactly this question: what sensitive data do we hold, and where. It inventories S3 general purpose buckets, then inspects object contents using managed data identifiers, built-in machine learning and pattern matching for many types of personally identifiable information, financial data and credentials. A sensitive data discovery job produces a finding per object it flags, which is the report the auditors want, with no scanning code to write.
Option A tells you who accessed an object, not what the object contains. Server access logs record requests; they say nothing about whether a file holds patient records.
Option B has the same limitation at a finer grain. CloudTrail data events capture object-level API activity for auditing access, but the payload of the object is never inspected.
Option C examines configuration, not content. A bucket can be encrypted, private and fully compliant with every Config rule while still containing thousands of unlabelled patient records, which is precisely the situation the company is trying to discover.
Reference: What is Amazon Macie?