Reasons Why Sensitive Data Is Not Detected Even After an Amazon Macie Job Completes

The Problem I Was Facing

To check whether an S3 bucket contains sensitive data, I created a sensitive data discovery job in Amazon Macie.
While the job was running, the "Approximate number of objects to process" increased, and the scan appeared to be progressing. However, when the job completed, this value became 0, and the expected findings were not produced.
I could not find any errors in CloudWatch or elsewhere, so please tell me the cause.

How Should I Handle This?

Checking the Specifications

In conclusion, it is normal behavior for the "Approximate number of objects to process" to become 0.
This value is the approximate number of objects that the job has not yet processed in the run. Therefore, once processing finishes, it becomes 0. The value becoming 0 does not in itself mean there is a problem with the configuration or permissions[1].
Also, if the status of a one-time job is "Complete", the job ran successfully and finished[2]. However, "Complete" does not mean that all objects were analyzed. Even if there are objects that could not be analyzed due to insufficient permissions or other reasons, the job itself can still end up as "Complete".

Points to Check When No Findings Are Produced

If the expected findings are not produced, check the following:

1. Storage class and file format of the target objects
   Objects in unsupported storage classes such as S3 Glacier Deep Archive are not analyzed[3]. Also, the file formats that can be analyzed are those with specified extensions such as .csv, .json, .pdf, and .gz[4]

2. Job scope settings
   Exclusion criteria take precedence over inclusion criteria[5] Also, if the sampling rate is less than 100%, only some of the target objects are analyzed

3. Permissions
   Check whether access from the Macie service-linked role (AWSServiceRoleForAmazonMacie) is denied by the bucket policy of the target bucket, and, if the bucket is encrypted with SSE-KMS, whether the KMS key policy allows Macie to decrypt

References

[1]Classification Job - Statistics

[2]Checking the status of a sensitive data discovery job - Job status values

[3]Supported storage classes and formats - Supported Amazon S3 storage classes

[4]Supported storage classes and formats - Supported file and storage formats

[5] Classification Job Creation - Scoping