Before opening a data lake to more teams, governance wants an automated inventory of which S3 objects contain PII. Which service discovers this?
A.Amazon Macie
Correct. Macie scans S3 for PII/sensitive data and reports where it lives.
B.AWS Glue crawler
Crawlers infer schemas — they classify structure, not sensitivity.
C.Amazon Inspector
Inspector finds software vulnerabilities in EC2/ECR/Lambda, not data content.
D.AWS Config
Config tracks resource configuration, not object contents.
Why this answer
Macie uses ML and pattern matching to discover sensitive data (PII, financial data, credentials) in S3 and reports object-level findings — the dedicated sensitive-data discovery service.
Correct answer: A · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Data Governance practice session.
Practice Data Governance