Amazon Macie reports PAN-like strings in a shared-drive style S3 bucket used by multiple departments. Which response design best remediates access after sensitive data discovery?
Select an answer to reveal the explanation.
Short Explanation
When Macie finds card-like numbers in the shared drive, you pull those objects into a locked room and shrink who has the key—tighten the bucket policy and KMS grants. Opening the floodgates or shredding logs makes it worse.
Full Explanation
Governance after sensitive-data discovery includes containing exposure: move or restrict objects, reduce principal access in bucket policies, and limit KMS decrypt grants to authorized roles. Expanding public access or disabling audit trails increases risk. Macie findings should drive concrete access remediation in the architecture.