Data Classification & Compliance

Overview

Data classification is the process of organizing data into categories that make it easier to apply appropriate security controls, meet compliance requirements, and manage data throughout its lifecycle. AWS provides services and features to help discover, classify, and protect sensitive data.

Understanding data classification is important for the SAA-C03 exam because it connects security controls to business and regulatory requirements. You need to know how to use Amazon Macie for sensitive data discovery, AWS Config for compliance monitoring, and how to implement classification through tagging and policies.

Key Concepts

Data Classification Levels

Amazon Macie

Amazon Macie is a fully managed data security service that uses machine learning to automatically discover, classify, and protect sensitive data in S3.

Amazon Macie:
├── Automatic Discovery
│   ├── Scans S3 buckets continuously
│   ├── Uses ML + pattern matching
│   └── Identifies sensitive data types
│
├── Sensitive Data Types
│   ├── Personal Identifiable Information (PII)
│   │   ├── Names, addresses, phone numbers
│   │   ├── Social Security Numbers
│   │   └── Email addresses
│   │
│   ├── Financial Data
│   │   ├── Credit card numbers
│   │   ├── Bank account numbers
│   │   └── Financial statements
│   │
│   └── Protected Health Information (PHI)
│       ├── Medical records
│       ├── Health insurance info
│       └── Prescription data
│
└── Custom Data Identifiers
    ├── Define your own patterns
    ├── Regex-based detection
    └── Organization-specific data

AWS Config for Compliance

AWS Config enables continuous compliance monitoring with rules that evaluate resource configurations:

Security & Encryption Rules:
├── s3-bucket-server-side-encryption-enabled
├── s3-bucket-ssl-requests-only
├── encrypted-volumes
├── rds-storage-encrypted
├── kms-cmk-not-scheduled-for-deletion
└── acm-certificate-expiration-check

Access Control Rules:
├── s3-bucket-public-read-prohibited
├── s3-bucket-public-write-prohibited
├── iam-user-mfa-enabled
├── iam-root-access-key-check
└── restricted-ssh

Data Protection Rules:
├── s3-bucket-versioning-enabled
├── dynamodb-pitr-enabled
├── rds-multi-az-support
└── backup-plan-min-frequency-and-min-retention-check

Data Residency & Sovereignty

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyNonEURegions",
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:RequestedRegion": [
            "eu-west-1",
            "eu-west-2",
            "eu-central-1"
          ]
        }
      }
    }
  ]
}

How It Works

Macie Discovery Process

1. ENABLE MACIE
   └── Enable for AWS account
   └── Configure S3 buckets to scan

2. AUTOMATED DISCOVERY
   └── Macie samples objects from buckets
   └── Uses ML classifiers + regex patterns
   └── Runs continuously (daily by default)

3. SENSITIVE DATA FINDINGS
   └── Generates findings for sensitive data
   └── Classifies by type (PII, financial, etc.)
   └── Includes location and severity

4. ACTIONS
   └── Send findings to Security Hub
   └── Trigger EventBridge rules
   └── Integrate with SIEM/alerting

5. REMEDIATION
   └── Review and remediate findings
   └── Apply encryption, access controls
   └── Update data handling procedures

Tagging for Classification

Recommended Tags:
├── DataClassification: Public | Internal | Confidential | Restricted
├── DataOwner: team-name or owner-email
├── ComplianceScope: HIPAA | PCI-DSS | SOC2 | GDPR
├── RetentionPeriod: 1-year | 3-year | 7-year | indefinite
└── CostCenter: department-code

Example S3 Bucket Tags:
{
  "DataClassification": "Restricted",
  "DataOwner": "security-team@company.com",
  "ComplianceScope": "PCI-DSS",
  "RetentionPeriod": "7-year",
  "Environment": "production"
}

Enforce with Tag Policies (AWS Organizations):
├── Require specific tags on resources
├── Enforce allowed values
└── Prevent resource creation without tags

AWS Security Hub Integration

Built-in Standards:
├── AWS Foundational Security Best Practices
├── CIS AWS Foundations Benchmark
├── PCI DSS v3.2.1
└── NIST SP 800-53

Integrations:
├── Amazon Macie (sensitive data)
├── Amazon GuardDuty (threat detection)
├── AWS Config (configuration compliance)
├── Amazon Inspector (vulnerability assessment)
├── IAM Access Analyzer (access findings)
└── AWS Firewall Manager (security policy)

Compliance Score:
├── Per-standard compliance percentage
├── Failed controls tracking
├── Prioritized findings by severity
└── Trend analysis over time

Compliance Programs

HIPAA (Healthcare)

PCI-DSS (Payment Cards)

GDPR (EU Data Protection)

Use Cases

Use Case 1: Discover PII in S3

Scenario: Company needs to identify all S3 buckets containing PII for GDPR compliance.

Solution:

• Enable Amazon Macie
• Configure automated sensitive data discovery
• Review findings for PII detections
• Apply appropriate encryption and access controls

Use Case 2: Enforce Encryption Compliance

Scenario: Ensure all S3 buckets and EBS volumes are encrypted.

Solution:

• Enable AWS Config rules:
  • s3-bucket-server-side-encryption-enabled
  • encrypted-volumes
• Set up auto-remediation with SSM Automation
• Report compliance status to Security Hub

Use Case 3: Data Residency for EU Customers

Scenario: EU customer data must remain in EU regions.

Solution:

• Use AWS Organizations SCPs to restrict regions
• Configure S3 bucket policies to deny cross-region replication
• Enable AWS Config rule to monitor region compliance
• Tag resources with geographic classification

Use Case 4: Classification-Based Access Control

Scenario: Only authorized users should access Restricted data.

Solution:

• Implement resource tagging for classification
• Use ABAC (Attribute-Based Access Control) with IAM
• Tag condition in IAM policies:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::*/*",
      "Condition": {
        "StringEquals": {
          "s3:ExistingObjectTag/DataClassification": "${aws:PrincipalTag/ClearanceLevel}"
        }
      }
    }
  ]
}

Best Practices

Data Classification Best Practices

1. Define classification scheme early

   • Establish levels before data collection
   • Document handling requirements per level
   • Train teams on classification criteria

2. Automate discovery

   • Use Macie for continuous S3 scanning
   • Custom data identifiers for business-specific data
   • Regular review of findings

3. Tag consistently

   • Enforce tagging through SCPs
   • Use AWS Tag Policies for consistency
   • Automate tagging where possible

4. Map controls to classification

   • Higher classification = stronger controls
   • Document control requirements
   • Audit compliance regularly

Compliance Best Practices

1. Enable Security Hub

   • Aggregate findings from all services
   • Enable relevant compliance standards
   • Set up automated notifications

2. Use AWS Config rules

   • Enable managed rules for common checks
   • Create custom rules for organization needs
   • Configure auto-remediation

3. Maintain audit trails

   • CloudTrail in all regions
   • S3 access logging for sensitive buckets
   • Centralized log analysis

4. Regular compliance reviews

   • Scheduled compliance assessments
   • Update controls as requirements change
   • Document compliance evidence

Common Exam Scenarios

Common Pitfalls

Related Services

Quick Reference

Macie Pricing

AWS Config Pricing

Macie Data Identifiers

Personal Information:
├── Name, Address, Phone, Email
├── Social Security Number (SSN)
├── Date of Birth
├── Driver License Number
└── Passport Number

Financial Data:
├── Credit Card Number (PAN)
├── CVV/CVC
├── Bank Account Number
├── IBAN, SWIFT Code
└── Financial Statement

Credentials:
├── AWS Access Keys
├── API Keys
├── Passwords in plaintext
├── SSH Private Keys
└── PGP Private Keys

Healthcare (PHI):
├── Health Insurance ID
├── Medical Record Number
├── Drug Names
└── Healthcare Provider Numbers

CLI Commands

# Enable Macie
aws macie2 enable-macie

# Create Macie classification job
aws macie2 create-classification-job \
  --job-type ONE_TIME \
  --s3-job-definition '{"bucketDefinitions":[{"accountId":"123456789012","buckets":["my-bucket"]}]}'

# List Macie findings
aws macie2 list-findings

# Enable AWS Config
aws configservice put-configuration-recorder \
  --configuration-recorder name=default,roleARN=arn:aws:iam::123456789012:role/config-role

# Put Config rule
aws configservice put-config-rule \
  --config-rule file://s3-encryption-rule.json

# Check compliance
aws configservice describe-compliance-by-config-rule

Test Your Knowledge

Further Reading

• Amazon Macie User Guide
• AWS Config Developer Guide
• AWS Security Hub User Guide
• AWS Compliance Programs
• AWS Well-Architected Security Pillar
• Data Classification Whitepaper