A company suspects that S3 buckets contain unencrypted customer records and card numbers. Which service discovers and classifies that data automatically?
Show answer and explanation
Answer: A
Macie samples and analyzes objects in S3 using managed and custom data identifiers to locate sensitive data such as names, addresses, and payment card numbers. Findings include the bucket, object, and type of sensitive data detected, plus a severity.
It also evaluates bucket security posture, flagging issues such as public access or missing encryption, which pairs naturally with the data discovery results.
Why the other options are wrong
- B. Inspector finds software vulnerabilities and unintended network exposure on compute resources, not sensitive data in objects.
- C. GuardDuty detects malicious activity and compromised credentials through threat signals.
- D. AWS Config tracks resource configuration and compliance state without inspecting object contents.
Exam tip. Macie inspects S3 contents; Inspector inspects workloads.