Amazon Macie reports high-severity sensitive personal data in a production bucket that receives customer uploads. The response must start within minutes, keep a copy of the evidence, and require no manual steps. Which design is best?
Show answer and explanation
Answer: C
Macie publishes findings as events to Amazon EventBridge. A rule that matches the finding type and severity can start an automated workflow. That workflow can copy the object into a restricted evidence bucket, remove it from its original location, and notify the owning team. Automation gives a fast and auditable response that does not depend on someone reading a report.
Why the other options are wrong
- A. A weekly manual export delays the response by days and relies on people to act. That conflicts with the requirement to respond within minutes without manual steps.
- B. Disabling Macie removes detection altogether. Versioning does not isolate the sensitive copy from users, so the exposure would continue.
- D. A public bucket increases the exposure of sensitive personal data and is the opposite of containment. It would also trigger compliance violations.