Using managed data identifiers in Amazon Macie
To discover sensitive data, Amazon Macie uses a combination of criteria and techniques, including machine learning and pattern matching, to analyze data that you specify. These criteria and techniques, referred to as managed data identifiers, are designed to detect a large and growing list of sensitive data types for many countries and regions, including multiple types of personally identifiable information (PII), personal health information (PHI), and financial data. Macie automatically uses these identifiers each time it analyzes objects in an Amazon Simple Storage Service (Amazon S3) bucket as part of a sensitive data discovery job that you create and run.
The topics in this section list and describe the different types of sensitive data that Macie can detect and relevant requirements for detecting that data.
Topics
For information about the types of data that Macie can analyze, see Supported file and storage formats.
Keyword requirements
To detect certain types of sensitive data, Macie requires a keyword to be in proximity of the data. If this is the case for a particular type of data, a subsequent topic in this section indicates specific keyword requirements for that data.
If a keyword has to be in proximity of a particular type of data, the keyword typically has to be within 30 characters (inclusively) of the data. Additional proximity requirements vary based on an S3 object's storage format or file type.
- Structured, columnar data
-
For columnar data, a keyword has to be part of the same value or in the name of the column or field that stores a value. This is true for Microsoft Excel workbooks, CSV files, and TSV files.
For example, if the value for a field contains both SSN and a nine-digit number that uses the syntax of a US Social Security number (SSN), Macie can detect the SSN in the field. Similarly, if the name of a column contains SSN, Macie can detect each SSN in the column. Macie treats the values in that column as being within proximity of the keyword SSN.
- Structured, record-based data
-
For record-based data, a keyword has to be part of the same value or in the name of an element in the path to the field or array that stores a value. This is true for Apache Avro object containers, Apache Parquet files, JSON files, and JSON Lines files.
For example, if the value for a field contains both credentials and a character sequence that uses the syntax of an AWS secret key, Macie can detect the key in the field. Similarly, if the path to a field is
$.credentials.aws.key, Macie can detect an AWS secret key in the field. Macie treats the value in the field as being within proximity of the keyword credentials. - Unstructured data
-
For Adobe Portable Document Format files, Microsoft Word documents, and non-binary text files other than CSV, JSON, JSON Lines, and TSV files, there aren't any additional proximity requirements. A keyword typically has to be within 30 characters (inclusively) of the data. This includes any structured data, such as tables, in these types of files.
Keywords aren’t case sensitive. In addition, if a keyword contains a space, Macie automatically matches keyword variations that don’t contain the space, or contain an underscore (_) or a hyphen (-) instead of the space.
Credentials
The following table lists and describes the types of credentials that Macie can detect.
| Data type | Keyword required | Additional information | Countries and regions |
|---|---|---|---|
| AWS secret keys | Yes, including: aws_secret_access_key, credentials, secret access key, secret key, set-awscredential | – |
Any |
| OpenSSH private keys | No | – |
Any |
| PGP private keys | No | – |
Any |
| Public-Key Cryptography Standard (PKCS) private keys | No | – |
Any |
| PuTTY private keys | No | – |
Any |
Financial information
The following table lists and describes the types of financial information that Macie can detect. These are in addition to certain types of data that might also qualify as personally identifiable information (PII).
| Data type | Keyword required | Additional information | Countries and regions |
|---|---|---|---|
|
Bank account number |
Yes, see Keywords for bank account numbers |
This includes:
|
Canada, France, Germany, Italy, Spain, UK, US |
|
Credit card expiration date |
Yes, including: expiration, expiry |
Supported formats include MM/YY and YY/MM. |
Any |
|
Credit card magnetic strip data |
Yes, including: card data, iso7813, mag, magstripe, stripe, swipe |
This includes tracks 1 and 2. |
Any |
|
Credit card number |
Varies* |
Detection requires the data to be a 13–19 digit sequence that adheres to the Luhn check formula and uses a standard card number prefix for any of the following types of credit cards: American Express, Dankort, Diner’s Club, Discover, Electron, Japanese Card Bureau (JCB), Mastercard, UnionPay, and Visa. |
Any |
|
Credit card verification code |
Yes, including: card id, card identification code, card identification number, card security code, card validation code, card validation number, card verification data, card verification value, cvc, cvc2, cvv, cvv2, elo verification code |
– |
Any |
* Macie supports two detection types for credit card numbers, one for credit card
numbers that are in proximity of a keyword (CREDIT_CARD_NUMBER) and another
for credit card numbers that aren't in proximity of a keyword
(CREDIT_CARD_NUMBER_(NO_KEYWORD)). For the former, required keywords
include: account number, american express, amex, bank card, card num, card number,
cc
#, ccn, check card, credit card, credit card#, dankort, debit card, diners club,
discover, electron, japanese card bureau, jcb, mastercard, mc, pan, payment account
number,
payment card number, pcn, union pay, visa.
Keywords for bank account numbers
To detect various types of bank account numbers, Macie requires a keyword to be in proximity of the numbers. This includes Canadian and US bank account numbers that consist of 6–19 digit sequences. This also includes International Bank Account Numbers (IBANs) that consist of up to 34 alphanumeric characters, including elements such as country code.
The following table lists the keywords that Macie recognizes for specific countries and regions.
| Country or region | Keywords |
|---|---|
| Canada | bank account, bank acct |
| France | account code, account number, accountno#, accountnumber#, bban, code bancaire, compte bancaire, customer account id, customer account number, customer bank account id, iban, numéro de compte |
| Germany | account code, account number, accountno#, accountnumber#, bankleitzahl, bban, customer account id, customer account number, customer bank account id, geheimzahl, iban, kartennummer, kontonummer, kreditkartennummer, sepa |
| Italy | account code, account number, accountno#, accountnumber#, bban, codice bancario, conto bancario, customer account id, customer account number, customer bank account id, iban, numero di conto |
| Spain | account code, account number, accountno#, accountnumber#, bban, código cuenta, código cuenta bancaria, cuenta cliente id, customer account ID, customer account number, customer bank account id, iban, número cuenta bancaria cliente, número cuenta cliente |
| UK | account code, account number, accountno#, accountnumber#, bban, customer account id, customer account number, customer bank account id, iban, sepa |
| US | bank account, bank acct |
Personal health information
The following table lists and describes the types of personal health information (PHI) that Macie can detect. These are in addition to certain types of data that might also qualify as personally identifiable information (PII).
| Data type | Keyword required | Additional information | Countries and regions |
|---|---|---|---|
|
Drug Enforcement Agency (DEA) Registration Number |
Yes, including: dea number, dea registration |
– |
US |
| Health Insurance Claim Number (HICN) | Yes, including: health insurance claim number, hic no, hic no., hic number, hic#, hicn, hicn#., hicno# | – | US |
| Health insurance or medical identification number | Yes, see Keywords for health insurance and medical identification numbers | This includes European Health Insurance Card numbers (EU, Finland), health insurance numbers (France), Medicare Beneficiary Identifiers (US), NHS numbers (UK), and Personal Health Numbers (Canada). | Canada, EU, Finland, France, UK, US |
| Healthcare Common Procedure Coding System (HCPCS) code | Yes, including: current procedural terminology, hcpcs, healthcare common procedure coding system | – | US |
| National Drug Code (NDC) | Yes, including: national drug code, ndc | – | US |
| National Provider Identifier (NPI) | Yes, including: hipaa, n.p.i, national provider, npi | – | US |
| Unique device identifier (UDI) | Yes, including: blood, blood bag, dev id, device id, device identifier, gs1, hibcc, iccbba, med, udi, unique device id, unique device identifier | As defined by the US Food and Drug Administration’s Global Unique Device Identification Database (GUDID). | US |
Keywords for health insurance and medical identification numbers
To detect various types of health insurance and medical identification numbers, Macie requires a keyword to be in proximity of the numbers. This includes European Health Insurance Card numbers (EU, Finland), health insurance numbers (France), Medicare Beneficiary Identifiers (US), National Insurance numbers (UK), NHS numbers (UK), and Personal Health Numbers (Canada).
The following table lists the keywords that Macie recognizes for specific countries and regions.
| Country or region | Keywords |
|---|---|
| Canada | canada healthcare number, msp number, personal healthcare number, phn, soins de santé |
| EU | assicurazione sanitaria numero, carta assicurazione numero, carte d’assurance maladie, carte européenne d'assurance maladie, ceam, ehic, ehic#, finlandehicnumber#, gesundheitskarte, hälsokort, health card, health card number, health insurance card, health insurance number, insurance card number, krankenversicherungskarte, krankenversicherungsnummer, medical account number, numero conto medico, numéro d’assurance maladie, numéro de carte d’assurance, numéro de compte medical, número de cuenta médica, número de seguro de salud, número de tarjeta de seguro, sairaanhoitokortin, sairausvakuutuskortti, sairausvakuutusnumero, sjukförsäkring nummer, sjukförsäkringskort, suomi ehic-numero, tarjeta de salud, terveyskortti, tessera sanitaria assicurazione numero, versicherungsnummer |
| Finland | ehic, ehic#, finland health insurance card, finlandehicnumber#, finska sjukförsäkringskort, hälsokort, health card, health card number, health insurance card, health insurance number, sairaanhoitokortin, sairaanhoitokortin, sairausvakuutuskortti, sairausvakuutusnumero, sjukförsäkring nummer, sjukförsäkringskort, suomen sairausvakuutuskortti, suomi ehic-numero, terveyskortti |
| France | carte d'assuré social, carte vitale, insurance card |
| UK | national health service, NHS |
| US | mbi, medicare beneficiary |
Personally identifiable information
Macie can detect the following types of personally identifiable information (PII).
| Data type | Keyword required | Additional information | Countries and regions |
|---|---|---|---|
|
Birth date |
Yes, including: bday, b-day, birth date, birthday, date of birth, dob |
This includes most date formats, such as all digits, and combinations of digits and names of months. Date components can be separated by spaces, slashes (/), or hyphens (-). |
Any |
| Driver’s license identification number | Yes, see Keywords for driver’s license identification numbers | – | Australia, Austria, Belgium, Bulgaria, Canada, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, UK, US |
| Electoral roll number | Yes, including: electoral #, electoral number, electoral roll #, electoral roll no., electoral roll number, electoralrollno | – | UK |
| Full name | No | Macie can detect full names only. Support is limited to Latin character sets. | Any |
| Global Positioning System (GPS) coordinates | Yes, including: coordinate, coordinates, lat long, latitude longitude, position |
Macie can detect GPS coordinates only if the latitude and longitude
coordinates are stored as a pair and they're in Decimal Degrees (DD) format,
for example: Support doesn't
include coordinates in Degrees Decimal Minutes (DDM) format, for example
|
Australia, Canada, Ireland, UK, US |
| Mailing address | No | Although a keyword isn't required, detection requires the address to include the name of a city or place. | Australia, Canada, France, Germany, Italy, Spain, UK, US |
| National identification number | Yes, see Keywords for national identification numbers | This includes Documento Nacional de Identidad (DNI) identifiers (Spain), French National Institute for Statistics and Economic Studies (INSEE) codes, German National Identity Card numbers, and Registro Geral (RG) numbers (Brazil). | Brazil, France, Germany, Italy, Spain |
| National Insurance Number (NINO) | Yes, including: insurance no., insurance number, insurance#, national insurance number, nationalinsurance#, nationalinsurancenumber, nin, nino | – | UK |
| Passport number | Yes, see Keywords for passport numbers | – | Canada, France, Germany, Italy, Spain, UK, US |
| Permanent residence number | Yes, including: carte résident permanent, numéro carte résident permanent, numéro résident permanent, permanent resident card, permanent resident card number, permanent resident no, permanent resident no., permanent resident number, pr no, pr no., pr non, pr number, résident permanent no., résident permanent non | – | Canada |
| Phone number |
Yes, including: cel, cell, celular, contact, fone, mobile, móvel, número residencial, numero residencial, phone, phone number, tel, telephone, telephone number |
This includes toll-free numbers in the US and fax numbers. If a keyword is in proximity of the data, the number doesn’t have to include a country code. If a keyword isn’t in proximity of the data, the number has to include a country code. |
Brazil, Canada, France, Germany, Italy, Spain, UK, US |
| Social Insurance Number (SIN) |
Yes, including: canadian id, numéro d'assurance sociale, sin, social insurance number Also refer to Keywords for health insurance and medical identification numbers |
– | Canada |
| Social Security number (SSN) | Yes, including:
|
– | Spain, US |
|
Taxpayer identification or reference number |
Yes, see Keywords for taxpayer identification and reference numbers |
This includes: CIF, NIE, and NIF (Spain); CNPJ and CPF (Brazil); Codice Fiscale (Italy); ITIN (US); Steueridentifikationsnummer (Germany); TFN (Australia); TIN (France); and, TRN, UTR (UK). |
Australia, Brazil, France, Germany, Italy, Spain, UK, US |
|
Vehicle identification number (VIN) |
Yes, including: Fahrgestellnummer, niv, numarul de identificare, numarul seriei de sasiu, numer VIN, Número de Identificação do Veículo, Número de Identificación de Automóviles, numéro d'identification du véhicule, vehicle identification number, vin, VIN numeris |
Macie can detect VINs that consist of a 17 character sequence and adhere to the ISO 3779 and 3780 standards. These standards were designed for worldwide use. |
Any, if the VIN is in proximity of a keyword in one of the following languages: English, French, German, Lithuanian, Polish, Portuguese, Romanian, or Spanish |
Keywords for driver’s license identification numbers
To detect various types of driver’s license identification numbers, Macie requires a keyword to be in proximity of the numbers. The following table lists the keywords that Macie recognizes for specific countries and regions.
| Country or region | Keywords |
|---|---|
| Australia | dl#, dl:, dlno#, driver licence, driver license, driver permit, drivers lic., drivers licence, driver's licence, drivers license, driver's license, drivers permit, driver's permit, drivers permit number, driving licence, driving license, driving permit |
| Austria | führerschein, fuhrerschein, führerschein republik österreich, fuhrerschein republik osterreich |
| Belgium | fuehrerschein, fuehrerschein- nr, fuehrerscheinnummer, fuhrerschein, führerschein, fuhrerschein- nr, führerschein- nr, fuhrerscheinnummer, führerscheinnummer, numéro permis conduire, permis de conduire, rijbewijs, rijbewijsnummer |
| Bulgaria | kørekort, kørekortnummer, превозно средство, свидетелство за управление на моторно, свидетелство за управление на мпс, сумпс, шофьорска книжка |
| Canada | dl#, dl:, dlno#, driver licence, driver licences, driver license, driver licenses, driver permit, drivers lic., drivers licence, driver's licence, drivers licences, driver's licences, drivers license, driver's license, drivers licenses, driver's licenses, drivers permit, driver's permit, drivers permit number, driving licence, driving license, driving permit, permis de conduire |
| Croatia | vozačka dozvola |
| Cyprus | άδεια οδήγησης |
| Czech Republic | číslo licence, císlo licence řidiče, číslo řidičského průkazu, ovladače lic., povolení k jízdě, povolení řidiče, řidiči povolení, řidičský prúkaz, řidičský průkaz |
| Denmark | kørekort, kørekortnummer |
| Estonia | juhi litsentsi number, juhiloa number, juhiluba, juhiluba number |
| Finland | ajokortin numero, ajokortti, förare lic., körkort, körkort nummer, kuljettaja lic., permis de conduire |
| France | permis de conduire |
| Germany | fuehrerschein, fuehrerschein- nr, fuehrerscheinnummer, fuhrerschein, führerschein, fuhrerschein- nr, führerschein- nr, fuhrerscheinnummer, führerscheinnummer |
| Greece | δεια οδήγησης, adeia odigisis |
| Hungary | illesztőprogramok lic, jogosítvány, jogsi, licencszám, vezető engedély, vezetői engedély |
| Ireland | ceadúnas tiomána |
| Italy | patente di guida, patente di guida numero, patente guida, patente guida numero |
| Latvia | autovadītāja apliecība, licences numurs, vadītāja apliecība, vadītāja apliecības numurs, vadītāja atļauja, vadītāja licences numurs, vadītāji lic. |
| Lithuania | vairuotojo pažymėjimas |
| Luxembourg | fahrerlaubnis, führerschäin |
| Malta | liċenzja tas-sewqan |
| Netherlands | permis de conduire, rijbewijs, rijbewijsnummer |
| Poland | numer licencyjny, prawo jazdy, zezwolenie na prowadzenie |
| Portugal | carta de condução, carteira de habilitação, carteira de motorist, carteira habilitação, carteira motorist, licença condução, licença de condução, número de licença, número licença, permissão condução, permissão de condução |
| Romania | numărul permisului de conducere, permis de conducere |
| Slovakia | číslo licencie, číslo vodičského preukazu, ovládače lic., povolenia vodičov, povolenie jazdu, povolenie na jazdu, povolenie vodiča, vodičský preukaz |
| Slovenia | vozniško dovoljenje |
| Spain | carnet conducer, el carnet de conducer, licencia conducer, licencia de manejo, número carnet conducer, número de carnet de conducer, número de permiso conducer, número de permiso de conducer, número licencia conducer, número permiso conducer, permiso conducción, permiso conducer, permiso de conducción |
| Sweden |
ajokortin numero, dlno# ajokortti, drivere lic., förare lic., körkort, körkort nummer, körkortsnummer, kuljettajat lic. דריווערס דערלויבעניש , שאפער דערלויבעניש נומער |
| UK | dl#, dl:, dlno#, driver licence, driver licences, driver license, driver licenses, driver permit, drivers lic., drivers licence, driver's licence, drivers licences, driver's licences, drivers license, driver's license, drivers licenses, driver's licenses, drivers permit, driver's permit, drivers permit number, driving licence, driving license, driving permit |
| US | dl#, dl:, dlno#, driver licence, driver licences, driver license, driver licenses, driver permit, drivers lic., drivers licence, driver's licence, drivers licences, driver's licences, drivers license, driver's license, drivers licenses, driver's licenses, drivers permit, driver's permit, drivers permit number, driving licence, driving license, driving permit |
Keywords for national identification numbers
To detect various types of national identification numbers, Macie requires a keyword to be in proximity of the numbers. This includes Documento Nacional de Identidad (DNI) identifiers (Spain), French National Institute for Statistics and Economic Studies (INSEE) codes, German National Identity Card numbers, and Registro Geral (RG) numbers (Brazil).
The following table lists the keywords that Macie recognizes for specific countries and regions.
| Country or region | Keywords |
|---|---|
| Brazil | registro geral, rg |
| France | assurance sociale, carte nationale d’identité, cni, code sécurité sociale, French social security number, fssn#, insee, insurance number, national id number, nationalid#, numéro d'assurance, sécurité sociale, sécurité sociale non., sécurité sociale numéro, social, social security, social security number, socialsecuritynumber, ss#, ssn, ssn# |
| Germany | ausweisnummer, id number, identification number, identity number, insurance number, personal id, personalausweis |
| Italy | codice fiscal, dati anagrafici, ehic, health card, health insurance card, p. iva, partita i.v.a., personal data, tax code, tessera sanitaria |
| Spain | dni, dni#, dninúmero#, documento nacional de identidad, identidad único, identidadúnico#, insurance number, national identification number, national identity, nationalid#, nationalidno#, número nacional identidad, personal identification number, personal identity no, unique identity number, uniqueid# |
Keywords for passport numbers
To detect various types of passport numbers, Macie requires a keyword to be in proximity of the numbers. The following table lists the keywords that Macie recognizes for specific countries and regions.
| Country or region | Keywords |
|---|---|
| Canada | passeport, passeport#, passport, passport#, passportno, passportno# |
| France | numéro de passeport, passeport #, passeport n °, passeport non |
| Germany | ausstellungsdatum, ausstellungsort, geburtsdatum, passport, passports, reisepass, reisepass–nr, reisepassnummer |
| Italy | italian passport number, numéro passeport, numéro passeport italien, passaporto, passaporto italiana, passaporto numero, passport number, repubblica italiana passaporto |
| Spain | españa pasaporte, libreta pasaporte, número pasaporte, pasaporte, passport, passport book, passport no, passport number, spain passport |
| UK | passeport #, passeport n °, passeport non, passeportn °, passport #, passport no, passport number, passport#, passportid |
| US | passport, travel document |
Keywords for taxpayer identification and reference numbers
To detect various types of taxpayer identification and reference numbers, Macie requires a keyword to be in proximity of the numbers. The following table lists the keywords that Macie recognizes for specific countries and regions.
| Country or region | Keywords |
|---|---|
| Australia | tax file number, tfn |
| Brazil | cadastro de pessoa física, cadastro de pessoa fisica, cadastro de pessoas físicas, cadastro de pessoas fisicas, cadastro nacional da pessoa jurídica, cadastro nacional da pessoa juridica, cnpj, cpf |
| France | numéro d'identification fiscal, tax id, tax identification number, tax number, tin, tin# |
| Germany | identifikationsnummer, steuer id, steueridentifikationsnummer, steuernummer, tax id, tax identification number, tax number |
| Italy | codice fiscal, dati anagrafici, ehic, health card, health insurance card, p. iva, partita i.v.a., personal data, tax code, tessera sanitaria |
| Spain | cif, cif número, cifnúmero#, nie, nif, número de contribuyente, número de identidad de extranjero, número de identificación fiscal, número de impuesto corporativo, personal tax number, tax id, tax identification number, tax number, tin, tin# |
| UK | paye, tax id, tax id no., tax id number, tax identification, tax identification#, tax no., tax number, tax reference, tax#, taxid#, temporary reference number, tin, trn, unique tax reference, unique taxpayer reference, utr |
| US | i.t.i.n., individual taxpayer identification number, itin |
