A company stores data in Amazon S3. According to regulations, the data must not contain personally identifiable information (PII). The company recently discovered that S3 buckets have some objects that contain PII. The company needs to automatically detect PII in S3 buckets and to notify the company’s security team. Which solution will meet these requirements?

Amazon Macie is the correct service for automatically discovering and protecting sensitive data, including PII, in Amazon S3. It uses machine learning and pattern matching to identify PII. Once Macie detects sensitive data, it generates findings. An Amazon EventBridge rule can then be configured to filter for specific Macie finding types, such as SensitiveData, and trigger an action. Sending an Amazon SNS notification to the security team is an effective way to alert them immediately, as SNS supports multiple subscription types (email, SMS, etc.). Amazon GuardDuty is incorrect because it is a threat detection service that monitors for malicious activity and unauthorized behavior, not for PII within S3 objects. Using Amazon SQS for notifications is less direct for immediate alerts to a team compared to SNS, which is designed for fan-out messaging to multiple subscribers.