# Implementing AWS Macie For Data Classification > 实施 Amazon Macie，利用机器学习和模式匹配自动发现、分类并保护 S3 存储桶中的敏感数据，包括 PII、金融数据和凭据检测。 - Skill: `killvxk/implementing-aws-macie-for-data-classification` (Agent Skill, multi-file: 8 files) - Install (CLI): `npx skillmds@latest add killvxk/implementing-aws-macie-for-data-classification` - Raw SKILL.md: https://api.skillmd.com/api/skills/killvxk/implementing-aws-macie-for-data-classification/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - License: Apache-2.0 - Author: killvxk (https://skillmd.com/u/killvxk) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/killvxk/implementing-aws-macie-for-data-classification --- # 实施 AWS Macie 进行数据分类 ## 概述 Amazon Macie（亚马逊 Macie）是一项全托管的数据安全与隐私服务，使用机器学习（Machine Learning）和模式匹配（Pattern Matching）来发现和保护 Amazon S3 中的敏感数据。Macie 每天自动评估您的 S3 存储桶清单，识别包含 PII（个人身份信息）、金融信息、凭据及其他敏感数据类型的对象。它提供两种发现方式：用于广泛可见性的自动化敏感数据发现，以及用于深度分析的定向发现任务。 ## 前置条件 - 拥有含待分类数据的 S3 存储桶的 AWS 账户 - 具备 Macie 服务配置所需的 IAM 权限 - 已配置 AWS Organizations（用于多账户部署） - S3 存储桶位于受支持的区域 ## 启用 Macie ### 通过 AWS CLI ```bash # 在当前账户/区域启用 Macie aws macie2 enable-macie # 验证 Macie 已启用 aws macie2 get-macie-session # 启用自动化敏感数据发现 aws macie2 update-automated-discovery-configuration \ --status ENABLED ``` ### 通过 Terraform ```hcl resource "aws_macie2_account" "main" {} resource "aws_macie2_classification_export_configuration" "main" { depends_on = [aws_macie2_account.main] s3_destination { bucket_name = aws_s3_bucket.macie_results.id key_prefix = "macie-findings/" kms_key_arn = aws_kms_key.macie.arn } } ``` ## 配置发现任务 ### 为特定存储桶创建分类任务 ```bash aws macie2 create-classification-job \ --job-type ONE_TIME \ --name "pii-scan-production-buckets" \ --s3-job-definition '{ "bucketDefinitions": [{ "accountId": "123456789012", "buckets": [ "production-data-bucket", "customer-records-bucket" ] }] }' \ --managed-data-identifier-selector ALL ``` ### 创建定期计划任务 ```bash aws macie2 create-classification-job \ --job-type SCHEDULED \ --name "weekly-sensitive-data-scan" \ --schedule-frequency-details '{ "weekly": { "dayOfWeek": "MONDAY" } }' \ --s3-job-definition '{ "bucketDefinitions": [{ "accountId": "123456789012", "buckets": ["all-data-bucket"] }], "scoping": { "includes": { "and": [{ "simpleScopeTerm": { "comparator": "STARTS_WITH", "key": "OBJECT_KEY", "values": ["uploads/", "documents/"] } }] } } }' ``` ## 自定义数据标识符 ### 为内部 ID 创建自定义标识符 ```bash aws macie2 create-custom-data-identifier \ --name "internal-employee-id" \ --description "匹配内部员工 ID 格式 EMP-XXXXXX" \ --regex "EMP-[0-9]{6}" \ --severity-levels '[ {"occurrencesThreshold": 1, "severity": "LOW"}, {"occurrencesThreshold": 10, "severity": "MEDIUM"}, {"occurrencesThreshold": 50, "severity": "HIGH"} ]' ``` ### 为项目代码创建标识符 ```bash aws macie2 create-custom-data-identifier \ --name "project-code-identifier" \ --description "匹配格式为 PRJ-XXXX-XX 的项目代码" \ --regex "PRJ-[A-Z]{4}-[0-9]{2}" \ --keywords '["project", "code", "initiative"]' \ --maximum-match-distance 50 ``` ## 允许列表 ### 创建允许列表以抑制误报 ```bash aws macie2 create-allow-list \ --name "test-data-exclusions" \ --description "排除已知测试数据模式" \ --criteria '{ "regex": "TEST-[0-9]{4}-[0-9]{4}-[0-9]{4}-[0-9]{4}" }' ``` ## 托管数据标识符 Macie 提供 300 余种托管数据标识符，涵盖以下类别： | 类别 | 示例 | |------|------| | **PII** | 社会安全号码、护照号码、驾驶证、出生日期、姓名、地址 | | **金融** | 信用卡号、银行账号、SWIFT 代码 | | **凭据** | AWS 密钥、API 密钥、SSH 私钥、OAuth 令牌 | | **医疗** | HIPAA 标识符、医疗保险理赔号 | | **法务** | 税务识别号、国家身份证号 | ## 发现结果管理 ### 列出发现结果 ```bash # 获取敏感数据发现结果 aws macie2 list-findings \ --finding-criteria '{ "criterion": { "severity.description": { "eq": ["High"] }, "category": { "eq": ["CLASSIFICATION"] } } }' \ --sort-criteria '{"attributeName": "updatedAt", "orderBy": "DESC"}' \ --max-results 25 ``` ### 获取发现结果详情 ```bash aws macie2 get-findings \ --finding-ids '["finding-id-1", "finding-id-2"]' ``` ### 将发现结果导出至 Security Hub ```bash # Macie 自动将发现结果发布到 Security Hub # 验证集成状态： aws macie2 get-macie-session --query 'findingPublishingFrequency' ``` ## EventBridge 集成与自动响应 ```json { "source": ["aws.macie"], "detail-type": ["Macie Finding"], "detail": { "severity": { "description": ["High", "Critical"] } } } ``` ### 用于自动修复的 Lambda 函数 ```python import boto3 import json s3 = boto3.client('s3') sns = boto3.client('sns') def lambda_handler(event, context): finding = event['detail'] severity = finding['severity']['description'] bucket = finding['resourcesAffected']['s3Bucket']['name'] key = finding['resourcesAffected']['s3Object']['key'] sensitive_types = [d['type'] for d in finding.get('classificationDetails', {}).get('result', {}).get('sensitiveData', [])] if severity in ['High', 'Critical']: # 为对象打标签以供审查 s3.put_object_tagging( Bucket=bucket, Key=key, Tagging={ 'TagSet': [ {'Key': 'macie-finding', 'Value': severity}, {'Key': 'sensitive-data', 'Value': ','.join(sensitive_types)}, {'Key': 'requires-review', 'Value': 'true'} ] } ) # 通知安全团队 sns.publish( TopicArn='arn:aws:sns:us-east-1:123456789012:security-alerts', Subject=f'Macie {severity} 发现结果: {bucket}/{key}', Message=json.dumps({ 'bucket': bucket, 'key': key, 'severity': severity, 'sensitive_data_types': sensitive_types, 'finding_id': finding['id'] }, indent=2) ) return {'statusCode': 200} ``` ## 多账户部署 ### 指定 Macie 管理员账户 ```bash # 从管理账户执行 aws macie2 enable-organization-admin-account \ --admin-account-id 111111111111 ``` ### 添加成员账户 ```bash # 从管理员账户执行 aws macie2 create-member \ --account '{"accountId": "222222222222", "email": "security@example.com"}' ``` ## 监控 Macie 运营状态 ### 使用量统计 ```bash aws macie2 get-usage-statistics \ --filter-by '[{"comparator": "GT", "key": "accountId", "values": []}]' \ --sort-by '{"key": "accountId", "orderBy": "ASC"}' ``` ### 分类任务状态 ```bash aws macie2 list-classification-jobs \ --filter-criteria '{"includes": [{"comparator": "EQ", "key": "jobStatus", "values": ["RUNNING"]}]}' ``` ## 参考资料 - AWS Macie 文档: https://docs.aws.amazon.com/macie/ - AWS Macie 定价 - Macie 分析支持的文件类型 - 使用 Macie 实现 GDPR 和 CCPA 合规