Using managed data identifiers in Amazon Macie - Amazon Macie

Using managed data identifiers in Amazon Macie

To discover sensitive data, Amazon Macie uses a combination of criteria and techniques, including machine learning and pattern matching, to analyze data that you specify. These criteria and techniques, referred to as managed data identifiers, are designed to detect a large and growing list of sensitive data types for many countries and regions, including multiple types of personally identifiable information (PII), personal health information (PHI), and financial data. Macie automatically uses these identifiers each time it analyzes data in an S3 bucket as part of a sensitive data discovery job that you create and run.

The topics in this section list and describe the different types of sensitive data that Macie can detect and relevant requirements for detecting that data.

For information about the types of data that Macie can analyze, see Supported file and storage formats.

Keyword requirements

To detect certain types of sensitive data, Macie requires a keyword to be in proximity of the data. If this is the case for a particular type of data, a subsequent topic in this section indicates the keyword requirements for that data.

If a keyword has to be in proximity of a particular type of data, the proximity requirements vary based on file type or storage format.

Unstructured data

For Adobe Portable Document Format files, Microsoft Word documents, and non-binary text files other than CSV and TSV files, a keyword typically has to be within 30 characters (inclusively) of the data. This includes any structured data, such as tables, in these types of files.

Structured data

For columnar and record-based data, a keyword has to be part of the same value or the name of the column or field that stores a value. This is true for Apache Avro object containers, Apache Parquet files, Microsoft Excel workbooks, CSV files, and TSV files.

For example, if a field contains both SSN and a nine-digit number that uses the syntax of a US Social Security number (SSN), Macie can detect the SSN in the field. Similarly, if a column name contains SSN, Macie can detect each SSN in the column. Macie treats the values in that column as being within proximity of the keyword SSN.

Keywords aren’t case sensitive. In addition, if a keyword contains a space, Macie automatically matches keyword variations that don’t contain the space, or contain an underscore (_) or a hyphen (-) instead of the space.

Credentials

The following table lists and describes the types of credentials that Macie can detect.

Data type Keyword required Additional information Countries and regions
AWS secret keys Yes, including: aws_secret_access_key, credentials, secret access key, secret key, set-awscredential

Any

OpenSSH private keys No

Any

PGP private keys No

Any

Public-Key Cryptography Standard (PKCS) private keys No

Any

PuTTY private keys No

Any

Financial information

The following table lists and describes the types of financial information that Macie can detect. These are in addition to certain types of data that might also qualify as personally identifiable information (PII).

Data type Keyword required Additional information Countries and regions

Bank account number

Yes, see Keywords for bank account numbers

This includes:

  • Canadian and US bank account numbers that consist of 6–19 digit sequences.

  • International Bank Account Numbers (IBANs) that consist of up to 34 alphanumeric characters, including elements such as country code.

Canada, France, Germany, Italy, Spain, UK, US

Credit card expiration date

Yes, including: expiration, expiry

Supported formats include MM/YY and YY/MM.

Any

Credit card magnetic strip data

Yes, including: card data, iso7813, mag, magstripe, stripe, swipe

This includes tracks 1 and 2.

Any

Credit card number

No

Although a keyword isn't required, detection requires the data to be a 13–19 digit sequence that adheres to the Luhn check formula and uses a standard card number prefix for any of the following types of credit cards: American Express, Dankort, Diner’s Club, Discover, Electron, Japanese Card Bureau (JCB), Mastercard, UnionPay, and Visa.

Any

Credit card verification code

Yes, including: card id, card identification code, card identification number, card security code, card validation code, card validation number, card verification data, card verification value, cvc, cvc2, cvv, cvv2, elo verification code

Any

Keywords for bank account numbers

To detect various types of bank account numbers, Macie requires a keyword to be in proximity of the numbers. This includes Canadian and US bank account numbers that consist of 6–19 digit sequences. This also includes International Bank Account Numbers (IBANs) that consist of up to 34 alphanumeric characters, including elements such as country code.

The following table lists the keywords that Macie recognizes for specific countries and regions.

Country or region Keywords
Canada bank account, bank acct
France account code, account number, accountno#, accountnumber#, bban, code bancaire, compte bancaire, customer account id, customer account number, customer bank account id, iban, numéro de compte
Germany account code, account number, accountno#, accountnumber#, bankleitzahl, bban, customer account id, customer account number, customer bank account id, geheimzahl, iban, kartennummer, kontonummer, kreditkartennummer, sepa
Italy account code, account number, accountno#, accountnumber#, bban, codice bancario, conto bancario, customer account id, customer account number, customer bank account id, iban, numero di conto
Spain account code, account number, accountno#, accountnumber#, bban, código cuenta, código cuenta bancaria, cuenta cliente id, customer account ID, customer account number, customer bank account id, iban, número cuenta bancaria cliente, número cuenta cliente
UK account code, account number, accountno#, accountnumber#, bban, customer account id, customer account number, customer bank account id, iban, sepa
US bank account, bank acct

Personal health information

The following table lists and describes the types of personal health information (PHI) that Macie can detect. These are in addition to certain types of data that might also qualify as personally identifiable information (PII).

Data type Keyword required Additional information Countries and regions

Drug Enforcement Agency (DEA) Registration Number

Yes, including: dea number, dea registration

US

Health Insurance Claim Number (HICN) Yes, including: health insurance claim number, hic no, hic no., hic number, hic#, hicn, hicn#., hicno# US
Health insurance or medical identification number Yes, see Keywords for health insurance and medical identification numbers This includes European Health Insurance Card numbers (EU, Finland), health insurance numbers (France), Medicare Beneficiary Identifiers (US), NHS numbers (UK), and Personal Health Numbers (Canada). Canada, EU, Finland, France, UK, US
Healthcare Common Procedure Coding System (HCPCS) code Yes, including: current procedural terminology, hcpcs, healthcare common procedure coding system US
National Drug Code (NDC) Yes, including: national drug code, ndc US
National Provider Identifier (NPI) Yes, including: hipaa, n.p.i, national provider, npi US
Unique device identifier (UDI) Yes, including: blood, blood bag, dev id, device id, device identifier, gs1, hibcc, iccbba, med, udi, unique device id, unique device identifier As defined by the US Food and Drug Administration’s Global Unique Device Identification Database (GUDID). US

Keywords for health insurance and medical identification numbers

To detect various types of health insurance and medical identification numbers, Macie requires a keyword to be in proximity of the numbers. This includes European Health Insurance Card numbers (EU, Finland), health insurance numbers (France), Medicare Beneficiary Identifiers (US), National Insurance numbers (UK), NHS numbers (UK), and Personal Health Numbers (Canada).

The following table lists the keywords that Macie recognizes for specific countries and regions.

Country or region Keywords
Canada canada healthcare number, msp number, personal healthcare number, phn, soins de santé
EU assicurazione sanitaria numero, carta assicurazione numero, carte d’assurance maladie, carte européenne d'assurance maladie, ceam, ehic, ehic#, finlandehicnumber#, gesundheitskarte, hälsokort, health card, health card number, health insurance card, health insurance number, insurance card number, krankenversicherungskarte, krankenversicherungsnummer, medical account number, numero conto medico, numéro d’assurance maladie, numéro de carte d’assurance, numéro de compte medical, número de cuenta médica, número de seguro de salud, número de tarjeta de seguro, sairaanhoitokortin, sairausvakuutuskortti, sairausvakuutusnumero, sjukförsäkring nummer, sjukförsäkringskort, suomi ehic-numero, tarjeta de salud, terveyskortti, tessera sanitaria assicurazione numero, versicherungsnummer
Finland ehic, ehic#, finland health insurance card, finlandehicnumber#, finska sjukförsäkringskort, hälsokort, health card, health card number, health insurance card, health insurance number, sairaanhoitokortin, sairaanhoitokortin, sairausvakuutuskortti, sairausvakuutusnumero, sjukförsäkring nummer, sjukförsäkringskort, suomen sairausvakuutuskortti, suomi ehic-numero, terveyskortti
France carte d'assuré social, carte vitale, insurance card
UK national health service, NHS
US mbi, medicare beneficiary

Personally identifiable information

Macie can detect the following types of personally identifiable information (PII).

Data type Keyword required Additional information Countries and regions

Birth date

Yes, including: bday, b-day, birth date, birthday, date of birth, dob

This includes most date formats, such as all digits, and combinations of digits and names of months. Date components can be separated by spaces, slashes (/), or hyphens (-).

Any

Driver’s license identification number Yes, see Keywords for driver’s license identification numbers Australia, Austria, Belgium, Bulgaria, Canada, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, UK, US
Electoral roll number Yes, including: electoral #, electoral number, electoral roll #, electoral roll no., electoral roll number, electoralrollno UK
Full name No Macie can detect full names only. Support is limited to Latin character sets. Any
Global Positioning System (GPS) coordinates Yes, including: coordinate, coordinates, lat long, latitude longitude, position

Macie can detect GPS coordinates only if the latitude and longitude coordinates are stored as a pair and they're in Decimal Degrees (DD) format, for example: 41.948614,-87.655311.

Support doesn't include coordinates in Degrees Decimal Minutes (DDM) format, for example 41°56.9168'N 87°39.3187'W, or Degrees, Minutes, Seconds (DMS) format, for example 41°56'55.0104"N 87°39'19.1196"W.

Australia, Canada, Ireland, UK, US
Mailing address No Although a keyword isn't required, detection requires the address to include the name of a city or place. Any
National identification number Yes, see Keywords for national identification numbers This includes Documento Nacional de Identidad (DNI) identifiers (Spain), French National Institute for Statistics and Economic Studies (INSEE) codes, German National Identity Card numbers, and Registro Geral (RG) numbers (Brazil). Brazil, France, Germany, Italy, Spain
National Insurance Number (NINO) Yes, including: insurance no., insurance number, insurance#, national insurance number, nationalinsurance#, nationalinsurancenumber, nin, nino UK
Passport number Yes, see Keywords for passport numbers Canada, France, Germany, Italy, Spain, UK, US
Permanent residence number Yes, including: carte résident permanent, numéro carte résident permanent, numéro résident permanent, permanent resident card, permanent resident card number, permanent resident no, permanent resident no., permanent resident number, pr no, pr no., pr non, pr number, résident permanent no., résident permanent non Canada
Phone number

Yes, including: cel, cell, celular, contact, fone, mobile, móvel, número residencial, numero residencial, phone, tel, telephone, telephone number

This includes toll-free numbers in the US and fax numbers.

If a keyword is in proximity of the data, the number doesn’t have to include a country code.

If a keyword isn’t in proximity of the data, the number has to include a country code.

Brazil, Canada, France, Germany, Italy, Spain, UK, US
Social Insurance Number (SIN)

Yes, including: canadian id, numéro d'assurance sociale, sin, social insurance number

Also refer to Keywords for health insurance and medical identification numbers

Canada
Social Security number (SSN) Yes, including:
  • Spain – número de la seguridad social, social security no., social security number, socialsecurityno#, ssn, ssn#

  • US – social security number, ss#, ssn

Spain, US

Taxpayer identification or reference number

Yes, see Keywords for taxpayer identification and reference numbers

This includes: CIF, NIE, and NIF (Spain); CNPJ and CPF (Brazil); Codice Fiscale (Italy); ITIN (US); Steueridentifikationsnummer (Germany); TFN (Australia); TIN (France); and, TRN, UTR (UK).

Australia, Brazil, France, Germany, Italy, Spain, UK, US

Vehicle identification number (VIN)

Yes, including: Fahrgestellnummer, niv, numarul de identificare, numarul seriei de sasiu, numer VIN, Número de Identificação do Veículo, Número de Identificación de Automóviles, numéro d'identification du véhicule, vehicle identification number, vin, VIN numeris

Macie can detect VINs that consist of a 17 character sequence and adhere to the ISO 3779 and 3780 standards. These standards were designed for worldwide use.

Any, if the VIN is in proximity of a keyword in one of the following languages: English, French, German, Lithuanian, Polish, Portuguese, Romanian, or Spanish

Keywords for driver’s license identification numbers

To detect various types of driver’s license identification numbers, Macie requires a keyword to be in proximity of the numbers. The following table lists the keywords that Macie recognizes for specific countries and regions.

Country or region Keywords
Australia dl#, dl:, dlno#, driver licence, driver license, driver permit, drivers lic., drivers licence, driver's licence, drivers license, driver's license, drivers permit, driver's permit, drivers permit number, driving licence, driving license, driving permit
Austria führerschein, fuhrerschein, führerschein republik österreich, fuhrerschein republik osterreich
Belgium fuehrerschein, fuehrerschein- nr, fuehrerscheinnummer, fuhrerschein, führerschein, fuhrerschein- nr, führerschein- nr, fuhrerscheinnummer, führerscheinnummer, numéro permis conduire, permis de conduire, rijbewijs, rijbewijsnummer
Bulgaria kørekort, kørekortnummer, превозно средство, свидетелство за управление на моторно, свидетелство за управление на мпс, сумпс, шофьорска книжка
Canada dl#, dl:, dlno#, driver licence, driver licences, driver license, driver licenses, driver permit, drivers lic., drivers licence, driver's licence, drivers licences, driver's licences, drivers license, driver's license, drivers licenses, driver's licenses, drivers permit, driver's permit, drivers permit number, driving licence, driving license, driving permit, permis de conduire
Croatia vozačka dozvola
Cyprus άδεια οδήγησης
Czech Republic číslo licence, císlo licence řidiče, číslo řidičského průkazu, ovladače lic., povolení k jízdě, povolení řidiče, řidiči povolení, řidičský prúkaz, řidičský průkaz
Denmark kørekort, kørekortnummer
Estonia juhi litsentsi number, juhiloa number, juhiluba, juhiluba number
Finland ajokortin numero, ajokortti, förare lic., körkort, körkort nummer, kuljettaja lic., permis de conduire
France permis de conduire
Germany fuehrerschein, fuehrerschein- nr, fuehrerscheinnummer, fuhrerschein, führerschein, fuhrerschein- nr, führerschein- nr, fuhrerscheinnummer, führerscheinnummer
Greece δεια οδήγησης, adeia odigisis
Hungary illesztőprogramok lic, jogosítvány, jogsi, licencszám, vezető engedély, vezetői engedély
Ireland ceadúnas tiomána
Italy patente di guida, patente di guida numero, patente guida, patente guida numero
Latvia autovadītāja apliecība, licences numurs, vadītāja apliecība, vadītāja apliecības numurs, vadītāja atļauja, vadītāja licences numurs, vadītāji lic.
Lithuania vairuotojo pažymėjimas
Luxembourg fahrerlaubnis, führerschäin
Malta liċenzja tas-sewqan
Netherlands permis de conduire, rijbewijs, rijbewijsnummer
Poland numer licencyjny, prawo jazdy, zezwolenie na prowadzenie
Portugal carta de condução, carteira de habilitação, carteira de motorist, carteira habilitação, carteira motorist, licença condução, licença de condução, número de licença, número licença, permissão condução, permissão de condução
Romania numărul permisului de conducere, permis de conducere
Slovakia číslo licencie, číslo vodičského preukazu, ovládače lic., povolenia vodičov, povolenie jazdu, povolenie na jazdu, povolenie vodiča, vodičský preukaz
Slovenia vozniško dovoljenje
Spain carnet conducer, el carnet de conducer, licencia conducer, licencia de manejo, número carnet conducer, número de carnet de conducer, número de permiso conducer, número de permiso de conducer, número licencia conducer, número permiso conducer, permiso conducción, permiso conducer, permiso de conducción
Sweden

ajokortin numero, dlno# ajokortti, drivere lic., förare lic., körkort, körkort nummer, körkortsnummer, kuljettajat lic.

דריווערס דערלויבעניש , שאפער דערלויבעניש נומער

UK dl#, dl:, dlno#, driver licence, driver licences, driver license, driver licenses, driver permit, drivers lic., drivers licence, driver's licence, drivers licences, driver's licences, drivers license, driver's license, drivers licenses, driver's licenses, drivers permit, driver's permit, drivers permit number, driving licence, driving license, driving permit
US dl#, dl:, dlno#, driver licence, driver licences, driver license, driver licenses, driver permit, drivers lic., drivers licence, driver's licence, drivers licences, driver's licences, drivers license, driver's license, drivers licenses, driver's licenses, drivers permit, driver's permit, drivers permit number, driving licence, driving license, driving permit

Keywords for national identification numbers

To detect various types of national identification numbers, Macie requires a keyword to be in proximity of the numbers. This includes Documento Nacional de Identidad (DNI) identifiers (Spain), French National Institute for Statistics and Economic Studies (INSEE) codes, German National Identity Card numbers, and Registro Geral (RG) numbers (Brazil).

The following table lists the keywords that Macie recognizes for specific countries and regions.

Country or region Keywords
Brazil registro geral, rg
France assurance sociale, carte nationale d’identité, cni, code sécurité sociale, French social security number, fssn#, insee, insurance number, national id number, nationalid#, numéro d'assurance, sécurité sociale, sécurité sociale non., sécurité sociale numéro, social, social security, social security number, socialsecuritynumber, ss#, ssn, ssn#
Germany ausweisnummer, id number, identification number, identity number, insurance number, personal id, personalausweis
Italy codice fiscal, dati anagrafici, ehic, health card, health insurance card, p. iva, partita i.v.a., personal data, tax code, tessera sanitaria
Spain dni, dni#, dninúmero#, documento nacional de identidad, identidad único, identidadúnico#, insurance number, national identification number, national identity, nationalid#, nationalidno#, número nacional identidad, personal identification number, personal identity no, unique identity number, uniqueid#

Keywords for passport numbers

To detect various types of passport numbers, Macie requires a keyword to be in proximity of the numbers. The following table lists the keywords that Macie recognizes for specific countries and regions.

Country or region Keywords
Canada passeport, passeport#, passport, passport#, passportno, passportno#
France numéro de passeport, passeport #, passeport n °, passeport non
Germany ausstellungsdatum, ausstellungsort, geburtsdatum, passport, passports, reisepass, reisepass–nr, reisepassnummer
Italy italian passport number, numéro passeport, numéro passeport italien, passaporto, passaporto italiana, passaporto numero, passport number, repubblica italiana passaporto
Spain españa pasaporte, libreta pasaporte, número pasaporte, pasaporte, passport, passport book, passport no, passport number, spain passport
UK passeport #, passeport n °, passeport non, passeportn °, passport #, passport no, passport number, passport#, passportid
US passport, travel document

Keywords for taxpayer identification and reference numbers

To detect various types of taxpayer identification and reference numbers, Macie requires a keyword to be in proximity of the numbers. The following table lists the keywords that Macie recognizes for specific countries and regions.

Country or region Keywords
Australia tax file number, tfn
Brazil cadastro de pessoa física, cadastro de pessoa fisica, cadastro de pessoas físicas, cadastro de pessoas fisicas, cadastro nacional da pessoa jurídica, cadastro nacional da pessoa juridica, cnpj, cpf
France numéro d'identification fiscal, tax id, tax identification number, tax number, tin, tin#
Germany identifikationsnummer, steuer id, steueridentifikationsnummer, steuernummer, tax id, tax identification number, tax number
Italy codice fiscal, dati anagrafici, ehic, health card, health insurance card, p. iva, partita i.v.a., personal data, tax code, tessera sanitaria
Spain cif, cif número, cifnúmero#, nie, nif, número de contribuyente, número de identidad de extranjero, número de identificación fiscal, número de impuesto corporativo, personal tax number, tax id, tax identification number, tax number, tin, tin#
UK paye, tax id, tax id no., tax id number, tax identification, tax identification#, tax no., tax number, tax reference, tax#, taxid#, temporary reference number, tin, trn, unique tax reference, unique taxpayer reference, utr
US i.t.i.n., individual taxpayer identification number, itin