TechPrufer
Sign inGet started

Blogs›Amazon›Automated PII Detection and Classification

Automated PII Detection and Classification

Automated PII Detection and Classification

2
posts
2026

This feature thread tracks the evolution of automated Personally Identifiable Information (PII) detection and classification capabilities on AWS. Initial efforts focused on foundational data security and compliance. This post introduces a comprehensive, event-driven pipeline that automates custom PII detection at scale using Amazon Macie and AWS Step Functions. It extends Macie's built-in capabilities with custom identifiers for organization-specific data, orchestrates scanning upon file ingesti. This post extends the thread by introducing a two-layer, defense-in-depth authorization pattern for granular, intra-tenant access control in RAG applications using Amazon Bedrock and Verified Permissions. This pattern allows for dynamic, runtime-evaluated authorization decisions based on Cedar policies, enabling fine-grained document-level access control at retrieval time within a single Amazon Bedrock Knowledge Bases instance, without redeploying code.

2026

Automate custom PII detection at scale with Amazon Macie and Step Functions | Amazon Web Services

7/22/2026

This post details the implementation of an event-driven pipeline for automated PII detection using Amazon Macie and AWS Step Functions. It introduces a solution that leverages Amazon EventBridge to trigger an AWS Step Functions workflow upon file ingestion into Amazon S3. The workflow orchestrates Macie classification jobs, including custom data identifiers, and generates compliance reports. Key architectural components include a three-bucket S3 pattern for data isolation, Lambda functions for job orchestration and status polling, and Amazon SNS for real-time alerts. The post provides a CloudFormation template for deployment and instructions for testing the pipeline, including configuring custom data identifiers.

Secure multi-tenant RAG with Amazon Bedrock and Verified Permissions | Amazon Web Services

6/22/2026

Introduces a two-layer, defense-in-depth authorization pattern for granular, intra-tenant access control in RAG applications using Amazon Bedrock and Verified Permissions. This pattern allows for dynamic, runtime-evaluated authorization decisions based on Cedar policies, enabling fine-grained document-level access control at retrieval time within a single Amazon Bedrock Knowledge Bases instance, without redeploying code. It details the use of Amazon API Gateway with Lambda Authorizer for initial API access control and a middleware Lambda function to orchestrate calls to Amazon Bedrock's RetrieveAndGenerate API with dynamically constructed metadata filters derived from Verified Permissions policy evaluations.