Macie

Question 1

Macie

What is Macie?

Answer 1

Discover, monitor, and protect data stored in S3 buckets

Question 2

Macie

How does it work / underlying tech?

Answer 2

Scans objects for PII, PHI, finance stuff, credit card numbers, PKI, AWS creds, addresses, …

Question 3

Macie

Two types of Identifiers?

Answer 3

AWS managed (built-in) and custom (you build them)

Question 4

Macie

What tech is used by Managed data identifiers?

Answer 4

ML and pattern-matching

Question 5

Macie

How can you create a custom Identifier?

Answer 5

Use a regex, for example

Question 6

Macie

What happens if Macie finds something?

Answer 6

Creates a Finding.

Question 7

Macie

What can you integrate with Findings?

Answer 7

AWS Security Hub, EventBridge

Question 8

Macie

How do you set up multi-account with Macie?

Answer 8

Automatic! Use Organizations or explicitly invite other accounts

Question 9

Macie

How do you launch Macie?

Answer 9

Create a Discovery Job: schedule, which data identifiers, which buckets

Question 10

Macie

Three things in a Custom Identifier?

Answer 10

Regex, keywords (with max distance), ignore words

Question 11

Macie

Two types of Findings?

Answer 11

Policy (bucket is open), Sensitive Data (matched an Identifier)

Question 12

Macie

Three examples of Policy Findings?

Answer 12

BlockPublicAccessDisabled, BucketEncryptionDisabled, BucketPublic

Question 13

Macie

Three examples of Sensitive Data?

Answer 13

Credentials, credit card number, mailing address