# Data Protection Tools and Services (Macie, S3 Object Lock, Glacier Vault Lock)

> Chapter 7 of the Courseiva AWS-SECURITY-SPECIALTY curriculum — https://courseiva.com/learn/aws-security-specialty/data-protection-tools

**Official objective:** 2.4 — Design and implement data protection controls

## Introduction

How do you stop someone from accidentally deleting a critical file or from a malicious insider altering financial records? That is the core question of data protection. For the AWS Certified Security Specialty SCS-C02 exam, you need to know the specific AWS services that provide discovery, immutability, and long-term archival controls.

## The Safety Deposit Box and Archive Analogy

A safety deposit box is a small, secure metal drawer inside a bank vault that you can only open with your key and the bank manager's key working together. This is the perfect metaphor for Amazon Web Services (AWS) data protection services. Your digital information is stored in the cloud, but it needs specific tools to remain confidential, unchanged, and everlasting.

First, consider Amazon Macie as your personal security guard who constantly reads every single document you place in the box. The guard doesn't just look for bombs; they look for secrets like passport numbers or credit card details. Macie uses machine learning to automatically discover and classify sensitive data stored in an Amazon Simple Storage Service (S3) bucket — which is like a massive digital warehouse full of boxes.

Second, think of S3 Object Lock as a tamper-proof envelope with a special glue. Once you put a document inside and seal it with a write-once-read-many (WORM) lock, no one can change or delete that document for a set period, not even the bank manager. This protects your data from being accidentally or deliberately overwritten or erased, satisfying strict regulatory requirements.

Finally, imagine storing boxes in a long-term deep-freeze unit far underground, the Glacier Vault Lock. You can only access these boxes after waiting for several hours for them to thaw. Glacier Vault Lock allows you to apply a policy to these frozen archives that cannot be changed afterwards, ensuring the data remains immutable for years. The central object of this analogy is the safety deposit box, representing your valuable data that requires these three distinct layers of protection.

## Core explanation

Data protection in AWS is about three main things: finding sensitive information, ensuring data cannot be changed (immutability), and preserving it for the long term. Three key services handle this: Amazon Macie, S3 Object Lock, and Glacier Vault Lock. Let us break each one down from the ground up.

Amazon Macie is an Artificial Intelligence (AI) service that helps you discover what sensitive data you have. If you store customer data in an S3 bucket, you might not realise a spreadsheet containing passport numbers or credit card details is sitting there. Macie automatically scans your S3 buckets, uses machine learning to identify patterns, and then tells you if it finds personally identifiable information (PII) — that is any data that can be used to identify a specific person. For example, it can spot a column of social security numbers or a set of API keys. It does not stop the data from being accessed; it simply raises a flag. This replaces the manual process of staring at thousands of files to check what is inside.

S3 Object Lock is a feature built into Amazon S3 that prevents objects — individual files — from being deleted or overwritten. It uses a concept called Write Once, Read Many (WORM). Once you set a retention period on an object, no one can modify or delete it until that period expires. Imagine a law firm that needs to keep case files for seven years. With S3 Object Lock, a paralegal cannot accidentally delete last week's brief. There are two main retention modes. Governance mode allows users with special permissions to bypass the lock, useful for testing or emergencies. Compliance mode is absolute; no one, not even the root user of the AWS account, can delete the object until the retention period ends. This is vital for legal compliance standards like the Securities and Exchange Commission (SEC) Rule 17a-4, which requires financial firms to keep records in a non-rewritable format.

Glacier Vault Lock is a feature for Amazon S3 Glacier, a storage service designed for data that is accessed rarely, like every few years or for legal discovery. Glacier Vault Lock allows you to apply a WORM policy to an archive vault. The key difference from S3 Object Lock is that once you lock the policy, it cannot be changed. You write the rules — for example, 'do not delete any file for 10 years' — and then you lock it. From that moment on, the policy itself is immutable. This replaces the need for expensive, on-premises tape backup systems. It is ideal for financial records that regulators can demand after many years.

These three services work together to form a robust data protection strategy. Macie tells you what you have and where the risks are. S3 Object Lock protects active files from alteration. Glacier Vault Lock protects your long-term archives from being tampered with. For the SCS-C02 exam, you need to know when to use which service. A common question might present a scenario about a bank that needs to ensure its transaction logs, stored in S3, are unchangeable for seven years. The trap is that you might pick Glacier Vault Lock, but if the data needs frequent access within those seven years, S3 Object Lock is the right answer because S3 is standard object storage, while Glacier is only for archival retrieval.

Finally, remember that these services do not encrypt data on their own. Encryption is a separate control, often using AWS Key Management Service (KMS) to create and manage cryptographic keys. Data protection is a layered approach. Macie finds the sensitive data, you then place it in an S3 bucket with Object Lock to prevent changes, and for data you will never touch again, you move it to a Glacier vault with Vault Lock. This three-step pipeline is what the exam expects you to understand.

## Real-world context

An IT professional at a healthcare clinic, let us call it 'MedSecure', is responsible for protecting patient records. This scenario walks through how they would use Macie, S3 Object Lock, and Glacier Vault Lock.

The company stores patient files containing health histories, diagnoses, and payment details in an S3 bucket. The first problem the IT professional faces is not knowing exactly what is in that bucket. They know it contains medical records, but do they also contain social security numbers or credit card details? To find out, they enable Amazon Macie. Macie scans the bucket and generates a sensitive data discovery result. It reveals that several old spreadsheets contain full credit card numbers, which is a security risk. The IT professional now knows exactly which files to isolate or delete.

Next, the clinic is legally required to keep each patient's treatment records for ten years without any changes. The IT professional sets up an S3 bucket for these records and enables S3 Object Lock with a compliance mode retention period of ten years. They upload the files. Now, even if a disgruntled employee tries to delete a record or an administrator accidentally overwrites a file, the operation fails. The clinic has a tamper-proof audit trail of all medical treatments. The IT professional must be careful: once locked in compliance mode, the ten-year period cannot be reduced. They must think ahead about the company's legal retention obligations.

After five years, the clinic decides to move older records that are no longer needed for daily operations to a cheaper storage tier. They transfer these files to an Amazon S3 Glacier vault. However, the legal requirement to not alter the records for ten years still applies. The IT professional creates a Glacier vault and applies a vault lock policy that states: 'no object in this vault can be deleted for the remaining five years of the ten-year retention period.' Before locking the policy, the vault is in a two-stage process. First, the policy is in 'pending' status. The IT professional has 24 hours to cancel the lock or modify the policy. This is a safety check. After 24 hours, if they initiate the lock again, the policy becomes 'locked' and immutable. The IT professional waits 24 hours, double-checks the policy, and then locks it. Now the archived data is safe.

In summary, the workflow is:
- Discover sensitive data using Macie.
- Protect active data using S3 Object Lock.
- Archive expired data using Glacier Vault Lock.

The IT professional also integrates these services with AWS CloudTrail to log every API call, providing an audit trail for compliance audits. They regularly review Macie findings to ensure new data is not being uploaded without proper controls. This real-world scenario demonstrates how these three services build a complete data protection strategy, exactly what you need to know for the exam.

## Exam focus

The SCS-C02 exam tests your ability to choose the correct data protection service for a given scenario. You will see scenario-based questions that describe a business requirement and ask which service or feature solves it. The traps often involve confusing immutability controls, retention modes, and service capabilities.

Key concepts tested:
- Macie is only for discovering and classifying sensitive data. It does not block access or encrypt data. The exam might describe a scenario where data needs to be found and protected. The trap is to pick Macie for protection. Macie only discovers; you must pair it with S3 Object Lock or encryption for protection.
- S3 Object Lock offers two modes: Governance and Compliance. Governance can be overridden by users with special permissions, while Compliance cannot be overridden by anyone. The exam loves to ask: what mode ensures no one, not even the root user, can remove the lock? The answer is always Compliance mode.
- Glacier Vault Lock is a WORM solution for archives. A common trap is that S3 Object Lock is also a WORM solution. The differentiator is access speed. S3 Object Lock works on standard S3 buckets where you can access data in milliseconds. Glacier Vault Lock works on Glacier vaults where retrieval takes minutes to hours. If the scenario requires immediate access to data, do not pick Glacier.
- Macie pricing is based on the amount of data scanned. The exam does not typically ask about pricing, but you should know that Macie generates findings in the AWS Management Console or via Amazon EventBridge. You do not need to know the exact cost, but you should know that it is a paid service.
- The concept of 'immutable' is central. Immutable means the data cannot be changed or deleted. Both S3 Object Lock and Glacier Vault Lock provide immutability. The exam might present a scenario asking for 'immutable' storage and both services are options. The deciding factor is the storage class (S3 or Glacier) and the required retrieval time.
- Vault Lock has a two-step process: initiate a lock in pending status, wait 24 hours, then complete the lock. The exam may ask what happens during those 24 hours. The answer is that you can cancel the lock and modify the policy. Once completed, the lock is permanent.

Trap patterns to watch for:
- A question says 'prevent deletion for 7 years' and offers both S3 Object Lock and Glacier Vault Lock. If the data needs to be frequently accessed within those 7 years, S3 Object Lock is correct. If the data is archived, Glacier Vault Lock is correct.
- A question says 'find sensitive data' and offers Macie, S3 Object Lock, and AWS KMS. The correct answer is Macie, because the question is about discovery, not encryption or immutability.
- A question says 'apply a retention policy that cannot be changed' and names both S3 Object Lock Compliance mode and Glacier Vault Lock. Both are immutable, but Glacier Vault Lock locks the policy itself, while S3 Object Lock locks the objects. Pay attention to whether the question wants to lock the data or lock the policy rules.

To pass, memorise these exact points:
- Macie = discovery only.
- S3 Object Lock = WORM for S3 objects. Governance = overrideable. Compliance = not overrideable.
- Glacier Vault Lock = WORM for Glacier archives. Policy is immutable once locked.
- Always consider the access pattern (frequent vs archival) when choosing between S3 Object Lock and Glacier Vault Lock.

## Step by step

1. **Enable Amazon Macie** — Navigate to the Amazon Macie console and enable it for your account. Macie will start to inventory your S3 buckets and begin scanning for sensitive data. You can also choose to run a one-time job or schedule recurring scans. This step is crucial because you cannot protect data you do not know you have.
2. **Review Macie Findings** — After the scan completes, Macie generates findings that list the specific files containing sensitive data, the type of data (like credit card numbers), and the bucket location. You must review these findings to understand your exposure. This informs your next steps on whether to move, encrypt, or delete the sensitive files.
3. **Create an S3 Bucket with Object Lock Enabled** — You create a new S3 bucket and enable S3 Object Lock at the bucket level. You must decide between Governance and Compliance modes. For most compliance scenarios, you select Compliance mode. This step replaces your old manual backup process with an automated, tamper-proof retention system.
4. **Set a Retention Period for Objects** — When you upload objects into the bucket, you apply a retention period, such as 7 years, either as a default on the bucket or per object. Once set, the object cannot be deleted or overwritten until the period expires. This step enforces the immutability requirement for regulatory compliance.
5. **Create a Glacier Vault and Apply a Lock Policy** — For data that is rarely accessed, you create a Glacier vault and write a vault lock policy that defines the retention rules, such as 'no deletions for 10 years'. After writing the policy, you initiate the lock. It enters a pending status for 24 hours. This waiting period is a safety check to ensure the policy is correct.
6. **Finalise the Glacier Vault Lock** — After the 24-hour pending period, you initiate the lock again to move it to the locked state. Now the policy is immutable and cannot be changed. Your archived data is fully protected against deletion or alteration. This step is critical for meeting long-term archival compliance requirements.

## Comparisons

### Amazon Macie vs S3 Object Lock

**Amazon Macie:**
- Detects and classifies sensitive data in S3 using machine learning.
- Does not prevent deletion or modification of data.
- Focuses on data discovery and inventory.
- Focuses on data discovery and inventory.

**S3 Object Lock:**
- Prevents deletion or modification of objects in S3 using WORM controls.
- Does not discover which data is sensitive.
- Focuses on data retention and immutability.
- Focuses on data retention and immutability.

### S3 Object Lock (Governance) vs S3 Object Lock (Compliance)

**S3 Object Lock (Governance):**
- Allows users with special permissions to delete or overwrite locked objects.
- Not suitable for strict legal compliance where no override is allowed.
- Useful for temporary retention or testing scenarios.
- Useful for temporary retention or testing scenarios.

**S3 Object Lock (Compliance):**
- No user can delete or overwrite locked objects, including the root user.
- Suitable for regulatory requirements like SEC Rule 17a-4.
- Retention period is unchangeable until it expires.
- Retention period is unchangeable until it expires.

### S3 Object Lock vs Glacier Vault Lock

**S3 Object Lock:**
- Operates on standard S3 storage with millisecond retrieval.
- Locks individual objects within a bucket.
- Requires no 24-hour waiting period for object locking.
- Requires no 24-hour waiting period for object locking.

**Glacier Vault Lock:**
- Operates on Glacier archival storage with retrieval times of minutes to hours.
- Locks the vault policy itself, not individual objects.
- Requires a 24-hour pending period before the policy is finalised.
- Requires a 24-hour pending period before the policy is finalised.

### Macie Discovery vs Manual Data Classification

**Macie Discovery:**
- Automatically scans S3 using machine learning and managed identifiers.
- Detects patterns like credit card numbers and passport IDs without human input.
- Generates findings that are immediately visible in the console.
- Generates findings that are immediately visible in the console.

**Manual Data Classification:**
- Requires a human to read every file and document what is inside.
- Prone to error and slow for large datasets.
- No automated alerting; relies on manual records.
- No automated alerting; relies on manual records.

## Diagram

_Decision flow for choosing between Macie, S3 Object Lock, and Glacier Vault Lock based on data sensitivity and access patterns._

```mermaid
flowchart TD
    A[Your Data in S3] --> B{Is data sensitive?}
    B -->|Yes| C[Amazon Macie scans and flags it]
    B -->|No| D[No action needed]
    C --> E{Do you need immutability?}
    E -->|Yes, frequent access| F[S3 Object Lock with Compliance]
    E -->|Yes, cold archive| G[Glacier Vault Lock]
    F --> H[Data protected for set retention]
    G --> I[Policy locked, data immutable for years]
```

## Common misconceptions

- **Misconception:** Macie can automatically block access to sensitive data after discovering it. **Reality:** Macie only discovers and classifies sensitive data. It does not have any blocking or encryption capabilities. You must use other services like S3 bucket policies or AWS Identity and Access Management (IAM) to block access. (Beginners hear 'security service' and assume it takes action. Macie is purely a detective control, not a preventive one.)
- **Misconception:** S3 Object Lock and Glacier Vault Lock are the same thing and can be used interchangeably. **Reality:** Both provide WORM immutability, but S3 Object Lock is for standard S3 buckets with millisecond retrieval, while Glacier Vault Lock is for Glacier archival storage with retrieval times of minutes to hours. They are not interchangeable. (The term 'lock' appears in both names, causing confusion. Beginners often ignore the storage type difference.)
- **Misconception:** Glacier Vault Lock can be unlocked if you need to delete data urgently. **Reality:** Once the vault lock policy is in the locked state, it cannot be changed or removed. The data is immutable for the duration specified in the policy. There is no undo button. (People are used to software with administrative overrides. Glacier Vault Lock is designed to meet strict regulatory standards that explicitly prohibit any override.)
- **Misconception:** S3 Object Lock's Governance mode works the same as Compliance mode for legal purposes. **Reality:** Governance mode allows users with specific IAM permissions to remove the lock. For rigorous legal compliance, only Compliance mode guarantees that no one, including the root user, can delete or modify the object during the retention period. (The word 'lock' implies permanence, so beginners assume all modes are equally strict without checking the documentation.)
- **Misconception:** Macie scans all AWS services for sensitive data. **Reality:** Macie currently only scans data in Amazon S3 buckets and is gradually adding support for other sources. It does not scan databases, EC2 volumes, or other storage services automatically. (The name 'Macie' sounds generic, leading people to assume it is a universal data scanner. AWS documentation clearly limits its scope.)
- **Misconception:** You must manually define what counts as sensitive data for Macie. **Reality:** Macie uses machine learning and managed data identifiers to automatically recognise a wide variety of sensitive data types, such as credit card numbers and passport numbers, without you having to define anything. (Beginners expect to manually enter patterns, not understanding that Macie uses automated pattern matching and ML.)

## Key takeaways

- Amazon Macie is a detective control that uses machine learning to discover and classify sensitive data in S3 buckets without blocking access.
- S3 Object Lock with Compliance mode guarantees that no user, including the root account, can delete or overwrite an object during its retention period.
- Glacier Vault Lock provides an immutable WORM policy for archived data where the policy itself cannot be changed once locked.
- Choosing between S3 Object Lock and Glacier Vault Lock depends on the storage class and required retrieval speed: use S3 for frequent access, Glacier for cold archives.
- Macie only scans S3 buckets, not database tables, EC2 volumes, or other AWS services.
- Glacier Vault Lock requires a 24-hour waiting period after the initial lock initiation, during which you can cancel and modify the policy.
- S3 Object Lock operates at the object level, while Glacier Vault Lock operates at the vault policy level.
- For examination questions, if the scenario mentions real-time access (milliseconds), select S3 Object Lock, not Glacier Vault Lock.

## FAQ

**What is the main difference between S3 Object Lock and Glacier Vault Lock?**

S3 Object Lock works on standard S3 buckets and provides immutability for frequently accessed files. Glacier Vault Lock works on archival Glacier vaults and provides immutability for data that is rarely accessed and where retrieval takes longer.

**Can Macie prevent someone from accessing a sensitive file?**

No, Macie is a detective control. It only discovers and classifies sensitive data, but it does not block access. You need to use S3 bucket policies, IAM roles, or encryption to prevent unauthorised access.

**What happens if I lock a Glacier vault and then discover the policy has an error?**

Once the vault lock policy is in the locked state, it cannot be changed. You would need to create a new vault, move your data, and apply a corrected policy. That is why there is a 24-hour pending period during which you can cancel and modify the policy.

**Does Macie scan data in Amazon RDS databases?**

No, Macie currently only scans data stored in Amazon S3 buckets. It does not scan Amazon RDS, DynamoDB, or other database services.

**Can an administrator override an S3 Object Lock in Compliance mode?**

No, compliance mode cannot be overridden by any user, including the AWS account root user. Only the retention period expiring will allow deletion or overwriting of the object.

**Is Glacier Vault Lock free to use?**

Using Glacier Vault Lock itself does not incur an additional fee beyond the standard Glacier storage costs. However, you are billed for the storage and retrieval of data in Glacier.

## Check your understanding

1. **Which mode of S3 Object Lock ensures that no user, including the root user, can delete an object before the retention period ends?**

   Answer: Compliance mode, because it provides an absolute lock that cannot be overridden by any user.

2. **What is the main function of Amazon Macie?**

   Answer: Amazon Macie automatically discovers and classifies sensitive data stored in S3 buckets using machine learning.

3. **If you need to securely store archived data for 10 years with a policy that cannot be changed after finalisation, which service should you use?**

   Answer: Glacier Vault Lock, because it locks the policy itself, making it immutable for archival data.

4. **What is the purpose of the 24-hour pending period in Glacier Vault Lock?**

   Answer: It allows you to cancel or modify the vault lock policy before it becomes permanently locked, serving as a safety check.

5. **Can Macie scan data in an Amazon RDS database?**

   Answer: No, Macie only scans data stored in Amazon S3 buckets and not in other services like RDS or DynamoDB.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/aws-security-specialty/data-protection-tools