NeonPay’s data lake in Amazon S3 contains large volumes of synthetic test data with known test credit card numbers that are triggering numerous Amazon Macie findings. The team needs to suppress these false positives while continuing to detect real PANs, with minimal changes to S3 data layout. What is the MOST effective approach?

The most effective approach is to create a Macie allow list. This allows you to define specific patterns (regex) or lists of known test credit card numbers that Macie should ignore. By associating this allow list with your sensitive data discovery job, Macie will suppress findings for these known test numbers, effectively eliminating false positives while still detecting real PANs. This method directly addresses the problem of known test data without impacting the detection of actual sensitive information. Disabling all PCI-related managed data identifiers would prevent Macie from detecting any credit card numbers, including real ones, which defeats the purpose of using Macie. Using S3 bucket policies to block Macie from scanning test-data prefixes is not a direct Macie configuration and might be overly broad or complex to manage for specific data patterns. Turning on automated sensitive data discovery only relies on sampling, which might reduce but not eliminate false positives, and doesn't offer the precise control of an allow list.