Macie reports payment-card numbers in objects in a log bucket that several applications can read. The card data is not needed after the logs are reviewed, and those objects are not fetched through a website. What should change?
Select an answer to reveal the explanation.
Short Explanation
The card numbers are sitting in a drawer a lot of people can open, and a lock on the shop door does not close that drawer. Macie found payment-card data in the log bucket, so you restrict who can read it and add a lifecycle rule so the objects do not stay after review. A web ACL does not see objects that are not fetched through the website, and turning Macie off only hides the report.
Full Explanation
Macie has found payment-card data at rest in a log bucket that several applications can read. The data is not needed after review, so two changes match the finding: narrow who can read the bucket, and add a lifecycle rule so the objects expire instead of sitting there. A web ACL inspects HTTP requests to a website. These objects are not fetched through a website, so a rule on that site does not remove the card numbers from the bucket and does not stop the applications that already read it. Turning Macie off closes the report and leaves the objects as they are. Opening the bucket to public read widens access, which is the opposite of a bucket that already has too many readers. Caveat: if versioning is enabled, the lifecycle rule also has to expire noncurrent versions, or the card numbers remain as an older version after the current object is removed. Operational check: confirm the bucket policy allows only the reviewers who still need the logs, then confirm a test object is expired by the lifecycle rule after review.