A compliance team must enforce a data classification scheme over hundreds of Amazon S3 buckets: objects containing sensitive personal data such as credit card and passport numbers must be discovered automatically, and each finding must drive a hands-off response that tags and restricts the affected bucket within minutes, using managed services with the least custom plumbing. Which two actions together meet this requirement? (Select TWO.)
- ARun an Amazon GuardDuty malware and threat analysis over the buckets so it classifies which objects hold sensitive personal data and reports them as findings.
- BConfigure an Amazon Macie sensitive data discovery job with managed data identifiers to scan the buckets and raise a finding for each object holding the personal data types. Correct
- CDeploy an AWS Config managed rule that evaluates each bucket's configuration and marks buckets non-compliant when they contain sensitive personal data.
- DEnable an Amazon Inspector continuous scan on the EC2 instances and ECR images near the buckets so its findings list any objects storing regulated personal data.
- ECreate an Amazon EventBridge rule that matches the Macie findings and targets an AWS Systems Manager Automation runbook to tag and restrict access to the affected bucket. Correct
Why A is wrong: GuardDuty detects threats from account and network activity and seems applicable, but it does not inspect object content for personal data, so it cannot perform the classification required.
Why B is correct: Macie discovery jobs with managed data identifiers inspect S3 object content and raise findings for credit card and passport data, delivering the automated classification half of the scheme.
Why C is wrong: AWS Config evaluates resource configuration rather than object content and looks compliance-aware, but it cannot read the data inside objects, so it never identifies sensitive records.
Why D is wrong: Inspector scans compute and container images for software vulnerabilities and seems security-relevant, but it never inspects S3 object content for classified data of any kind.
Why E is correct: Macie publishes findings to EventBridge, and an EventBridge rule invoking a Systems Manager Automation runbook applies the tag and access restriction within minutes, delivering the hands-off response half.