What it does. Enable and configure Amazon Macie via AWS CLI/Terraform to discover, classify, and protect sensitive data (PII, financial data, credentials) in S3 using ML and pattern matching, including discovery jobs, custom data identifiers, allow lists, and EventBridge-based remediation. Use when setting up S3 data classification, cloud DLP, or auditing S3 for unprotected sensitive data. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/implementing-aws-macie-for-data-classification/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-aws-macie-for-data-classification, or copy the skill folder into ~/.claude/skills/implementing-aws-macie-for-data-classification/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aws-macie-for-data-classification/SKILL.md

SKILL.md (verbatim)

name: implementing-aws-macie-for-data-classification
description: Enable and configure Amazon Macie via AWS CLI/Terraform to discover, classify, and protect sensitive data (PII, financial data, credentials) in S3 using ML and pattern matching, including discovery jobs, custom data identifiers, allow lists, and EventBridge-based remediation. Use when setting up S3 data classification, cloud DLP, or auditing S3 for unprotected sensitive data.
domain: cybersecurity
subdomain: cloud-security
tags:
- aws
- macie
- data-classification
- s3
- pii
- sensitive-data
- dlp
- compliance
version: '1.0'
author: mahipal
license: Apache-2.0
atlas_techniques:
- AML.T0043
- AML.T0018
nist_ai_rmf:
- GOVERN-1.1
- GOVERN-4.2
- MAP-2.3
- MEASURE-2.7
- MEASURE-2.5
nist_csf:
- PR.IR-01
- ID.AM-08
- GV.SC-06
- DE.CM-01
mitre_attack:
- T1078.004
- T1530
- T1537
- T1580
- T1003

Implementing AWS Macie for Data Classification

Overview

Amazon Macie is a fully managed data security and privacy service that uses machine learning and pattern matching to discover and protect sensitive data in Amazon S3. Macie automatically evaluates your S3 bucket inventory on a daily basis and identifies objects containing PII, financial information, credentials, and other sensitive data types. It provides two discovery approaches: automated sensitive data discovery for broad visibility and targeted discovery jobs for deep analysis.

When to Use

• When deploying or configuring implementing aws macie for data classification capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• AWS account with S3 buckets containing data to classify
• IAM permissions for Macie service configuration
• AWS Organizations setup (for multi-account deployment)
• S3 buckets in supported regions

Enable Macie

Via AWS CLI

# Enable Macie in the current account/region
aws macie2 enable-macie

# Verify Macie is enabled
aws macie2 get-macie-session

# Enable automated sensitive data discovery
aws macie2 update-automated-discovery-configuration \
  --status ENABLED

Via Terraform

resource "aws_macie2_account" "main" {}

resource "aws_macie2_classification_export_configuration" "main" {
  depends_on = [aws_macie2_account.main]

  s3_destination {
    bucket_name = aws_s3_bucket.macie_results.id
    key_prefix  = "macie-findings/"
    kms_key_arn = aws_kms_key.macie.arn
  }
}

Configure Discovery Jobs

Create a classification job for specific buckets

aws macie2 create-classification-job \
  --job-type ONE_TIME \
  --name "pii-scan-production-buckets" \
  --s3-job-definition '{
    "bucketDefinitions": [{
      "accountId": "123456789012",
      "buckets": [
        "production-data-bucket",
        "customer-records-bucket"
      ]
    }]
  }' \
  --managed-data-identifier-selector ALL

Create a scheduled recurring job

aws macie2 create-classification-job \
  --job-type SCHEDULED \
  --name "weekly-sensitive-data-scan" \
  --schedule-frequency-details '{
    "weekly": {
      "dayOfWeek": "MONDAY"
    }
  }' \
  --s3-job-definition '{
    "bucketDefinitions": [{
      "accountId": "123456789012",
      "buckets": ["all-data-bucket"]
    }],
    "scoping": {
      "includes": {
        "and": [{
          "simpleScopeTerm": {
            "comparator": "STARTS_WITH",
            "key": "OBJECT_KEY",
            "values": ["uploads/", "documents/"]
          }
        }]
      }
    }
  }'

Custom Data Identifiers

Create a custom identifier for internal IDs

aws macie2 create-custom-data-identifier \
  --name "internal-employee-id" \
  --description "Matches internal employee ID format EMP-XXXXXX" \
  --regex "EMP-[0-9]{6}" \
  --severity-levels '[
    {"occurrencesThreshold": 1, "severity": "LOW"},
    {"occurrencesThreshold": 10, "severity": "MEDIUM"},
    {"occurrencesThreshold": 50, "severity": "HIGH"}
  ]'

Create identifier for project codes

aws macie2 create-custom-data-identifier \
  --name "project-code-identifier" \
  --description "Matches project codes in format PRJ-XXXX-XX" \
  --regex "PRJ-[A-Z]{4}-[0-9]{2}" \
  --keywords '["project", "code", "initiative"]' \
  --maximum-match-distance 50

Allow Lists

Create an allow list to suppress false positives

aws macie2 create-allow-list \
  --name "test-data-exclusions" \
  --description "Exclude known test data patterns" \
  --criteria '{
    "regex": "TEST-[0-9]{4}-[0-9]{4}-[0-9]{4}-[0-9]{4}"
  }'

Managed Data Identifiers

Macie provides 300+ managed data identifiers covering:

Category	Examples
PII	SSN, passport numbers, driver's license, date of birth, names, addresses
Financial	Credit card numbers, bank account numbers, SWIFT codes
Credentials	AWS secret keys, API keys, SSH private keys, OAuth tokens
Health	HIPAA identifiers, health insurance claim numbers
Legal	Tax identification numbers, national ID numbers

Findings Management

List findings

# Get sensitive data findings
aws macie2 list-findings \
  --finding-criteria '{
    "criterion": {
      "severity.description": {
        "eq": ["High"]
      },
      "category": {
        "eq": ["CLASSIFICATION"]
      }
    }
  }' \
  --sort-criteria '{"attributeName": "updatedAt", "orderBy": "DESC"}' \
  --max-results 25

Get finding details

aws macie2 get-findings \
  --finding-ids '["finding-id-1", "finding-id-2"]'

Export findings to Security Hub

# Macie automatically publishes findings to Security Hub
# Verify integration:
aws macie2 get-macie-session --query 'findingPublishingFrequency'

EventBridge Integration for Automated Response

{
  "source": ["aws.macie"],
  "detail-type": ["Macie Finding"],
  "detail": {
    "severity": {
      "description": ["High", "Critical"]
    }
  }
}

Lambda function for automated remediation

import boto3
import json

s3 = boto3.client('s3')
sns = boto3.client('sns')

def lambda_handler(event, context):
    finding = event['detail']
    severity = finding['severity']['description']
    bucket = finding['resourcesAffected']['s3Bucket']['name']
    key = finding['resourcesAffected']['s3Object']['key']
    sensitive_types = [d['type'] for d in finding.get('classificationDetails', {}).get('result', {}).get('sensitiveData', [])]

    if severity in ['High', 'Critical']:
        # Tag the object for review
        s3.put_object_tagging(
            Bucket=bucket,
            Key=key,
            Tagging={
                'TagSet': [
                    {'Key': 'macie-finding', 'Value': severity},
                    {'Key': 'sensitive-data', 'Value': ','.join(sensitive_types)},
                    {'Key': 'requires-review', 'Value': 'true'}
                ]
            }
        )

        # Notify security team
        sns.publish(
            TopicArn='arn:aws:sns:us-east-1:123456789012:security-alerts',
            Subject=f'Macie {severity} Finding: {bucket}/{key}',
            Message=json.dumps({
                'bucket': bucket,
                'key': key,
                'severity': severity,
                'sensitive_data_types': sensitive_types,
                'finding_id': finding['id']
            }, indent=2)
        )

    return {'statusCode': 200}

Multi-Account Deployment

Designate Macie administrator account

# From the management account
aws macie2 enable-organization-admin-account \
  --admin-account-id 111111111111

Add member accounts

# From the administrator account
aws macie2 create-member \
  --account '{"accountId": "222222222222", "email": "security@example.com"}'

Monitoring Macie Operations

Usage statistics

aws macie2 get-usage-statistics \
  --filter-by '[{"comparator": "GT", "key": "accountId", "values": []}]' \
  --sort-by '{"key": "accountId", "orderBy": "ASC"}'

Classification job status

aws macie2 list-classification-jobs \
  --filter-criteria '{"includes": [{"comparator": "EQ", "key": "jobStatus", "values": ["RUNNING"]}]}'

References

• AWS Macie Documentation: https://docs.aws.amazon.com/macie/
• AWS Macie Pricing
• Supported File Types for Macie Analysis
• GDPR and CCPA Compliance with Macie

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

AWS Macie Data Classification Template

Configuration

Setting	Value
Administrator Account
Regions Enabled
Automated Discovery	Enabled / Disabled
Finding Publication	15min / 1hr / 6hr
Export Bucket

S3 Bucket Coverage

Bucket	Classification Job	Sensitive Data Found	Action Taken

Custom Data Identifiers

Name	Regex Pattern	Severity Levels	Purpose

Findings Summary

Severity	Count	Top Data Type	Remediation Status
Critical
High
Medium
Low

references/api-reference.md (verbatim)

API Reference: AWS Macie Data Classification Agent

Dependencies

Library	Version	Purpose
boto3	>=1.28	AWS SDK for Macie2 sensitive data discovery

CLI Usage

python scripts/agent.py \
  --profile security-audit \
  --region us-east-1 \
  --output-dir /reports/ \
  --output macie_report.json

Functions

get_macie_client(profile, region)

Creates boto3 Macie2 client with optional named profile.

enable_macie(client) -> dict

Calls client.get_macie_session() to check status, then client.enable_macie() if needed.

list_s3_buckets_summary(client) -> list

Calls client.describe_buckets() to get bucket inventory with encryption, public access, and classifiable object counts.

create_classification_job(client, bucket_names, job_name) -> dict

Calls client.create_classification_job(jobType="ONE_TIME", s3JobDefinition={...}) for targeted sensitive data discovery.

get_finding_statistics(client) -> dict

Calls client.get_finding_statistics(groupBy=...) for severity and type breakdowns.

list_findings(client, severity, max_results) -> list

Calls client.list_findings() with severity criterion, then client.get_findings(findingIds=[...]) for details.

generate_report(client) -> dict

Orchestrates all functions and compiles summary with public bucket identification.

boto3 Macie2 Methods Used

Method	Purpose
enable_macie(status)	Enable Macie service
describe_buckets(criteria)	S3 bucket inventory
create_classification_job(...)	Start discovery job
get_finding_statistics(groupBy)	Finding aggregations
list_findings(findingCriteria)	Filter findings
get_findings(findingIds)	Detailed finding data

Output Schema

{
  "summary": {"total_buckets": 45, "public_buckets": 2, "high_findings": 12},
  "bucket_inventory": [{"name": "my-bucket", "public_access": "NOT_PUBLIC"}],
  "high_findings": [{"type": "SensitiveData:S3Object/Personal", "bucket": "data-lake"}]
}

references/standards.md (verbatim)

Standards - AWS Macie for Data Classification

Compliance Frameworks Supported

• GDPR Article 30: Records of processing activities
• CCPA: California Consumer Privacy Act data discovery
• HIPAA: Protected health information identification
• PCI DSS 4.0: Cardholder data discovery (Requirement 3)
• SOC 2: Data classification and protection controls

AWS Well-Architected Security Pillar

• SEC 8: Protect data at rest
• SEC 10: Prepare for security events

NIST 800-53 Controls

• RA-5: Vulnerability Monitoring and Scanning
• SC-28: Protection of Information at Rest
• SI-4: System Monitoring
• MP-4: Media Storage

references/workflows.md (verbatim)

Workflows - AWS Macie Data Classification

Implementation Workflow

1. Enable Macie → Configure administrator account
2. Bucket Inventory → Review automated S3 inventory
3. Discovery Jobs → Create targeted classification jobs
4. Custom Identifiers → Add organization-specific patterns
5. Allow Lists → Suppress known false positives
6. Automation → EventBridge + Lambda for response
7. Reporting → Dashboard and Security Hub integration

Remediation Workflow

1. Finding Generated → Macie detects sensitive data
2. Triage → Security team reviews severity and data type
3. Classify → Determine data classification level
4. Protect → Apply encryption, access controls, or relocate
5. Validate → Re-scan to confirm remediation
6. Document → Update data classification inventory

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.