What Is Amazon Macie? The Librarian Who Reads Your Buckets

Jake's AWS security dashboard was finally green. Six services watching doors, locks, and ledgers. Then Ethan asked one question that undid the whole comfortable feeling: "Which of your buckets actually contains customer data?" Jake opened his mouth. Closed it. He had no idea.

What is AWS Macie? Amazon Macie is the librarian of AWS security — the only service in the family that opens your S3 buckets and reads what's inside, then tells you which ones hold sensitive data: phone numbers, card numbers, credentials, personal information. It also watches every bucket's security settings and flags the one that quietly becomes public.

And here is the number this post is honest about before anything else: Macie charges $1.00 per gigabyte it reads. Per unit, that makes the librarian the most expensive employee in the entire building😅 — and the difference between a $2 bill and a $651 bill is knowing exactly how she works before you hand her the warehouse keys.

Back to Jake's silence, because it's the most common silence in small-business cloud security.

Over the last few posts Jake has built a genuinely respectable setup for his phone-repair shop's AWS account. GuardDuty watches for intruders. Inspector checks the locks. Config writes everything down. Security Hub collects it all at the front desk. His score went from 43% to 71% and he's earned the right to feel good about it.

But every one of those services has the same blind spot, and Ethan put his finger straight on it.

"They watch doors, Jake. Locks, ledgers, movement. Not one of them has ever opened a filing cabinet and read a file. Remember the bucket your cousin almost left public? Everyone told you it was almost public. Nobody could tell you what was in it — whether that near-miss was a shrug or a disaster."

"So which was it?"

"That," Ethan said, "is exactly the question Macie exists to answer. And before you click anything, we're doing the pricing first this time. Macie is the one service in this family where clicking around cheerfully can genuinely sting."

First, Meet the Librarian: What AWS Macie Is Used For

Macie has exactly two jobs, and keeping them separate in your head is the key to understanding both the value and the bill.

Job 1 — watching the bucket doors (cheap)

The moment you enable Macie, it builds an inventory of every S3 general purpose bucket in your account and starts monitoring each one's security and access control: is it publicly accessible, is it encrypted, is it shared with other accounts. If a bucket's posture changes for the worse — the classic "someone made it public at 2 a.m. to fix a website and forgot" — Macie raises a policy finding. This job costs $0.10 per bucket per month. For Jake's eight buckets: 80 cents.

Job 2 — reading the books (the $1/GB part)

The second job is the famous one: Macie retrieves objects from your buckets and inspects the contents for sensitive data. When it finds some, it raises a sensitive data finding that says, in effect: "this object in this bucket contains what looks like 4,000 phone numbers and 212 card numbers — here's exactly where." This is the job billed at $1.00 per gigabyte analyzed, and it's the job the rest of this post teaches you to aim carefully.

How Does AWS Macie Work?

Under the hood, Macie reads objects using what AWS calls managed data identifiers — a large, maintained library of machine-learning models and patterns that recognize sensitive data types across many countries and regions: personally identifiable information (names, national IDs, phone numbers, addresses), financial information (card numbers, account numbers), and credentials (secret keys, private keys). So yes — to answer a question people genuinely type into Google — AWS Macie does use AI, in the unglamorous, useful sense: machine learning plus pattern matching, not a chatbot.

Three tools let you tune what the librarian flags:

• Managed data identifiers — the built-in library above. On by default, maintained by AWS.
• Custom data identifiers — your own regex patterns, optionally with keywords and a proximity rule. This is how Macie learns what your sensitive data looks like: internal customer IDs, repair-ticket numbers, anything proprietary.
• Allow lists — text Macie should ignore: your shop's own public phone number, sample data, test cards. This is how you stop the librarian flagging the same harmless thing forever.

Automated Discovery vs Targeted Jobs: The Choice That Decides Your Bill

Macie reads data in two modes, and this table is the single most useful thing to understand before enabling anything:

The librarian metaphor holds up all the way down: automated discovery is her walking the aisles pulling one book per shelf to learn what each section holds. A targeted job is her sitting down and reading a section cover to cover. You want both — in that order.

AWS Macie Pricing in Plain Numbers

Here is the whole pricing model, US East, straight from AWS's pricing page:

And AWS's own worked examples, which deserve more attention than they get, because they climb fast: 15 buckets with no scanning = $1.50/month. The same 15 buckets with 10 million objects and 150 GB of automated discovery = $151.50/month. Add a 500 GB targeted job and the month lands at $651.50. Same account, same buckets — the only variable is how many gigabytes you asked the librarian to read.

Small extras ride along too: the S3 GET/LIST requests Macie makes are billed as normal S3 requests, and if objects are encrypted with customer-managed KMS keys, decrypting them for analysis uses KMS — a thread we'll pull properly in the next post.

Jake's Bill, Computed Honestly

Jake's shop account: 8 buckets, about 40 GB of data total, a few hundred thousand objects. From the published rates:

• Bucket monitoring: 8 × $0.10 = $0.80/month
• Object monitoring: a few hundred thousand objects ≈ a few cents
• Automated discovery sampling: a small share of 40 GB per month; with the first GB free, call it $1–3/month depending on how much it samples
• One deliberate, one-time targeted job on his two customer-data buckets (say 6 GB): $6, once

Total: roughly $2–4 a month, plus a $6 one-time deep read of the buckets that actually matter. That is what Macie costs when you aim it. The $651.50 scenario is what it costs when you don't. Both numbers are true; only one of them needs to be yours.

The Free-Trial Trap (Yes, AWS Did It Again)

If you read the Config post, you already know this pattern: Security Hub's trial was free while Config quietly billed underneath it. Macie has its own version, and it's written plainly on AWS's pricing page where nobody looks:

One genuine kindness in the design deserves equal airtime: during the trial, Macie's console shows estimated post-trial costs based on your actual usage — so before day 30 you can see, in dollars, what staying enabled will cost. Look at that number before the trial ends, not after the first invoice.

A 10-Minute Setup: Enabling Macie Without Regret

The order of operations Ethan walked Jake through:

1. Enable Macie from its console page. The 30-day trial starts; the bucket inventory builds itself within minutes.
2. Check the automated discovery setting (Macie → Settings). New accounts typically get it turned on — decide consciously whether you want it, because after the trial it becomes the recurring $1/GB-sampled line. For most small accounts it's worth keeping: with the 1 GB monthly free allowance, light sampling of a small estate costs very little.
3. Spend the first week just reading the bucket inventory. Public access, encryption, sharing — the 80-cents-a-month half of Macie often pays for the whole visit before a single object is scanned.
4. Let automated discovery paint the map. Its findings and statistics show which buckets look sensitive — that's the librarian's aisle-walk.
5. Then, and only then, run one targeted job — scoped to the buckets the map flagged, with the GB math done on paper first. Not "all buckets." Never "all buckets" on the first run.
6. Wire the alarm (next section) so findings reach your phone, not just the console you'll forget to open.

The $0 Alarm You Already Built Still Works

Continuity payoff. In the Security Hub post we built one EventBridge rule — new CRITICAL findings, workflow NEW → SNS email — and said it would cover every service that reports to the front desk.

Macie is one of them. It publishes findings to EventBridge automatically, and it can publish to Security Hub as well. Wiring it takes about a minute:

1. Open Macie's Settings page.
2. Find the Publish findings to AWS Security Hub option and turn it on (choose whether policy findings, sensitive data findings, or both should flow through).
3. Done — the EventBridge rule from the Security Hub post now fires for the librarian's findings too. Nothing else to build, nothing new to pay.

A bucket goes public at 2 a.m., or a scan finds card numbers where none should be: same email, same phone, no new spend. If you skipped that post, the alarm recipe is in it — it remains the best free fifteen minutes in this series.

Macie vs GuardDuty vs Inspector: The Family, Complete

With the librarian hired, the security family Jake has met across this series is complete. One table, the whole staff:

The pairing people mix up most: Inspector asks "can this be broken into?" Macie asks "what would be lost if it were?" Different risks, commonly run together — a bucket full of card numbers behind perfect locks still deserves to be known about, and an empty bucket with terrible locks is a shrug.

What Macie Won't Do (Read Before Relying on It)

• It reads S3 only. Sensitive data in RDS, DynamoDB, EFS, or on an EC2 disk is invisible to it. If your customer database lives in RDS, Macie watching S3 is guarding the library while the vault sits across the street.
• It never fixes or redacts anything. Macie reports; remediation is yours. "Can AWS Macie redact PII?" is a common search and the honest answer is a flat no — it will tell you exactly which object and where, and then it hands you the mop.
• It is not a full DLP suite. It doesn't watch email, endpoints, or network egress the way enterprise data-loss-prevention products (or Microsoft Purview on the Azure side) try to. It's S3-native data discovery and bucket monitoring, done well, priced per GB.
• It can't read what it can't decrypt. Objects encrypted with keys Macie has no permission to use are skipped — worth remembering when a "clean" scan report covers less than you think it does.

Do You Actually Need Macie?

The gentlest test in the series, and it's one question: do your buckets hold other people's information?

A hobby account — your own projects, your own files, nothing about anyone else — does not need a librarian. Save the money; the free bucket-public-access checks built into S3 itself cover the worst mistake.

But the moment customer data enters S3 — a CSV export, a backup of anything with names and numbers in it, repair tickets, invoices — you've crossed the line Jake crossed without noticing. In most places that data is regulated (GDPR in the UK and EU, state privacy laws in the US, the DPDP Act in India), and "I didn't know that file was in there" has never once impressed a regulator. Macie's bucket monitoring at $0.10 a bucket is the cheapest possible answer to knowing. That's not a sales pitch — the same paragraph told hobby accounts to skip it. It's the librarian's actual job description: you can't protect what you haven't read.

Questions You're Probably About to Ask

What is AWS Macie in simple terms?

The librarian of AWS security: it reads what's inside your S3 buckets, flags sensitive data (PII, financial, credentials), and watches every bucket's security settings for changes like becoming public. S3 only.

How does AWS Macie work?

Machine learning and pattern matching ("managed data identifiers") detect many types of PII, financial data, and credentials; you can add custom regex identifiers and allow lists. It reads in two modes: automated discovery that samples across all buckets continually, and targeted jobs that deep-read the buckets you choose.

Is AWS Macie free?

No — but the 30-day trial covers bucket monitoring and up to 150 GB of automated discovery, and after that a small account's recurring cost is genuinely modest ($0.10/bucket plus 1 GB of free sampling monthly). The $1.00/GB analysis fee is where bills grow, and targeted jobs are never free, trial or not.

Is AWS Macie expensive?

Per unit, it's the priciest member of the security family — $1.00 per GB read. Whether your bill is $2 or $651 (both real numbers from AWS's own examples) depends entirely on aiming: sample broadly with automated discovery, deep-read narrowly with targeted jobs.

How is AWS Macie priced, exactly?

US East: $0.10 per bucket per month for security monitoring; $0.01 per 100,000 objects per month for automated-discovery object tracking; $1.00 per GB of data analyzed (automated discovery gets 1 GB free monthly). Plus ordinary S3 request charges and KMS decryption where applicable. AWS's pricing calculator can model your account before you enable anything.

Is AWS Macie only for S3?

Yes — general purpose S3 buckets only. It cannot read RDS, DynamoDB, EFS, or EC2 disks. If your sensitive data lives elsewhere, Macie can't be your only control.

Is AWS Macie a DLP tool?

It's the S3-shaped piece of one. True data-loss-prevention suites also watch email, endpoints, and network traffic; Macie discovers and monitors sensitive data in S3 and hands findings to your other tooling. Calling it "DLP for S3" is fair; calling it your whole DLP program is not.

Can AWS Macie redact PII?

No. It finds and reports; it never modifies objects. Redaction, deletion, or re-encryption is your move afterward — typically automated via the EventBridge findings it publishes.

Does AWS Macie use AI?

Yes, in the working sense: machine learning plus pattern matching to recognize sensitive data types, and sampling techniques to keep automated discovery affordable. No chatbot involved.

AWS Macie vs Inspector — which do I need?

Different questions: Inspector finds vulnerabilities (unpatched software in EC2, Lambda, containers) — "can this be broken into?" Macie finds sensitive data in S3 — "what would be lost?" If you hold customer data on running workloads, the honest answer is eventually both.

AWS Macie vs GuardDuty?

GuardDuty watches activity (logs, behavior, threats in motion); Macie reads contents (what's stored and how sensitive it is). The guard watches movement; the librarian reads shelves. They complement, not compete.

AWS Macie vs Amazon Comprehend?

Comprehend is a developer NLP service — you send it text, it returns entities, sentiment, and can flag PII in that text, priced per request. Macie is a managed security service that goes to your S3 buckets itself, on a schedule, with findings, dashboards, and Security Hub integration. Build-your-own vs switched-on.

AWS Macie vs Microsoft Purview?

Purview is Microsoft's data governance and compliance family, strongest across Microsoft 365 and Azure estates. Macie is AWS-native and S3-specific. Multi-cloud shops often end up with both, each covering its own side of the street.

Does Macie work across multiple AWS accounts?

Yes — via AWS Organizations (or invitations), a designated Macie administrator account can enable and manage Macie for member accounts, see their bucket inventories and policy findings, and run sensitive data discovery across the organization.

How do I stop Macie charges?

Turn off automated discovery in Macie's settings to stop the recurring analysis line, don't run targeted jobs, and you're down to $0.10/bucket monitoring. Disabling Macie entirely (also in settings) stops all charges — expect your findings and configuration to go with it, so export anything you need first.

Will a runaway targeted job bankrupt me?

There's a real brake: targeted discovery has a default quota of 5 TB per account, and jobs pause when they hit it (AWS Support can raise it to 25 TB if you genuinely need more). At $1.00/GB, 5 TB is still a $5,000 ceiling — the brake prevents infinity, not carelessness. Scope your jobs.

What comes after Macie in this series?

AWS KMS — the locksmith. The librarian just told you which buckets hold data worth protecting; KMS is the service holding the encryption keys that protect it, and deciding who may use those keys is the whole game. That post is next.

Coming Up Next

Jake's last question was the right one: "Macie found the card numbers. The bucket says 'encrypted.' Who's holding the key to that encryption — me or Amazon?"

That question has a better answer than most people expect, and a couple of billing surprises of its own — including why "encrypted" on a bucket's label can mean four different things, only some of which would actually protect Jake's customers if a laptop full of credentials walked out the door. AWS KMS — the locksmith who holds the keys to your data — is the next stop in this series, and it finishes the question Macie just opened: knowing where the sensitive data is was half the job; controlling who can unlock it is the other half.

Related Guides

Every price and mechanism in this post comes from AWS's Macie pricing page and documentation as of September 1, 2026, US East (N. Virginia) rates; Jake's bill is arithmetic on those published numbers with the assumptions stated in the text. AWS moves prices and trial terms — treat their pricing page as the living source and this post as the map that makes it readable.

If you enabled Macie this week and you're staring at your first findings list feeling slightly sick about what it found — breathe. Finding out is the good version of this story: every finding is something you now know about before anyone else does, and each one has a fix (lock the bucket, move the file, delete what should never have been kept). You're not behind; you're finally looking. That already puts you ahead of most of the internet.