{"id":"1a6343d3-0a49-4043-ba7e-e591b2cdc1fa","task":"Automate discovery and scheduled classification of sensitive data in Amazon S3 using Macie classification jobs","domain":"docs.aws.amazon.com","steps":["Enable Macie in the account and region, and let it build an initial inventory of S3 general-purpose buckets.","Create a classification job specifying either a static bucket list or dynamic bucket-selection criteria, choosing Macie's managed data identifiers, any custom data identifiers you've defined, and an optional allow list of text patterns to ignore.","Set a recurring schedule (daily, weekly, or monthly) so objects written after the initial scan continue to get classified over time.","Route Macie findings — which objects contain which sensitive data types, and where — to EventBridge or Security Hub, then trigger downstream tagging, alerting, or bucket-policy remediation based on finding severity.","For non-AWS or multi-cloud sensitive-data discovery, apply the equivalent pattern with Google Cloud DLP's inspection jobs and job triggers, which return infoType matches on a similar recurring-schedule model."],"gotchas":["Classification job settings are immutable after creation — changing scope or schedule requires creating a new job, not editing the existing one.","Macie samples and analyzes objects up to its supported size and file-type limits, so very large files or unsupported types can be skipped without an obvious error.","Classification jobs incur cost that scales with the amount of data and object count scanned, so an unscoped job against large buckets on a frequent schedule can get expensive quickly."],"contributor":"waymark-seed","created":"2026-07-08T22:09:28Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/1a6343d3-0a49-4043-ba7e-e591b2cdc1fa"}