- [Instructor] Welcome, everyone.
In this video, I'm gonna walk through using Amazon Macie
to analyze Excel files stored in an Amazon S3 bucket
for the presence of sensitive data,
such as Social Security numbers and names.
More specifically, I'm gonna use a combination
of managed data identifiers and custom data identifiers
and show you what the resulting findings look like,
and then compare the findings
with the data in the Excel file.
Through this video, you will gain an understanding
of how using the right keywords and custom data identifiers
can make your findings data more precise.
First, let's start out by taking a look
at the data in our Excel file.
As you can see, we have a number of different data points
in this Excel file that can be labeled as sensitive.
For example, names, addresses,
credit card numbers, and US Social Security numbers.
One important item to note is that the employee ID number
is the exact same format as the Social Security numbers.
Now that we're in the Macie console,
let's start by creating our first job.
Now that we're on the managed data identifier page,
I'm gonna select three managed data identifiers,
which are name, credit card number,
and US Social Security number.
Amazon Macie uses a combination of criteria and techniques,
including machine learning and pattern matching,
to detect sensitive data.
These criteria and techniques are collectively referred to
as managed data identifiers.
Now that we have those selected,
let's move on by selecting Next.
On the custom data identifiers page,
you can see that I have custom data identifiers
that I've already created.
A custom data identifier is a set of criteria
that you define to detect sensitive data.
The only difference in these two data identifiers
is that the second one does not include any keyword.
I'll pivot to show you how these two look.
As you can see, I've written a basic regex pattern
to look for numbers formatted
in a three-two-four structure.
Within custom data identifiers,
we also have the ability to use keywords,
which help Macie more accurately pinpoint the data
that a custom data identifier is targeting.
We can also specify words to ignore,
match distance from keyword,
and what we want our severity to be.
So, if I move over to other custom data identifier,
we can see here the only difference
is that this one is using a keyword.
For the first job, we select the custom data identifier
that is not using a keyword.
Now that our job is completed,
we see Macie found sensitive data
and generated a finding for this file.
In the right side of the screen, we can see more details
in the specific sensitive data items that were found.
We can see, under Financial Information,
Macie found 24 credit card numbers,
and, under Personal Information,
Macie found 24 names and 24 Social Security numbers.
Under the custom data identifier,
we see that Macie found 48 employee IDs,
which seems like more than we had in our Excel file.
If we select the number next to a data identifier,
names, for example,
we can see more detailed information
on where in the file Macie found this data.
For example, we can see the cell reference, column number,
column name, and row number.
If we want to get this detail for all 24 data points,
you can use this finding to navigate
to the corresponding sensitive data discovery result in S3
that provides detailed location data
for as many as 1,000 occurrences
of each type of sensitive data
that Macie detects in an object.
Pivoting to our Excel file,
we can see that there are indeed 24 names,
credit card numbers, and US Social Security numbers.
Unfortunately, it seems like there are only 24 employee IDs
and not 48, like was found
from our first custom data identifier.
But we can see that the Macie managed data identifier
was more accurate,
that it was able to determine the difference
between the employee IDs and Social Security numbers,
unlike our custom data identifier.
So now, let's create our second job,
which is gonna be configured the exact same way
except we will use the custom data identifier
that is utilizing a keyword.
We will utilize this keyword
to improve the custom data identifier
to give Macie the context and where to more specifically
look for the employee ID data pattern.
As we can see, now using a keyword
in our custom data identifier,
we have found only 24 data points for all data identifiers,
which we would expect based on the data in our Excel file.
In this video, we have gone over how to configure
Amazon Macie's sensitive data discovery jobs
to look for multiple sensitive data points in an Excel file
using a combination of managed and custom data identifiers.
We also learned the power of using keywords
in custom data identifiers to give Macie more context
to search for and find specific data.
If you want to dig into any more Amazon Macie topics,
please visit aws.amazon.com/macie.