AWS Macie cost: per GB of S3 data evaluated for sensitive data

Quick answer

Macie bills a small per-bucket monthly charge for S3 bucket inventory and monitoring, plus a per-GB charge for objects analyzed by sensitive-data discovery jobs, tiered. Repeatedly scanning entire large buckets drives the bill, so scoping jobs to relevant data, sampling rather than scanning everything, and scheduling discovery sensibly are the main levers.

Amazon Macie discovers and protects sensitive data in S3, and its cost has two parts: an ongoing inventory and monitoring charge per bucket, and a per-gigabyte charge for the sensitive-data discovery jobs that actually inspect object contents. The discovery jobs are where the cost grows, because scanning terabytes of objects adds up.

Bucket monitoring and data discovery

Component	Bills for
Bucket inventory / monitoring	Per S3 bucket per month
Sensitive-data discovery	Per GB of objects analyzed, tiered

The per-bucket charge covers automated inventory and access monitoring across your S3 estate. Sensitive-data discovery jobs inspect object contents for PII and other sensitive data, billed per gigabyte analyzed, with rates falling at volume. Running discovery over large buckets repeatedly is the main cost driver.

Scope and sample discovery

You do not need to scan every object on every run. Scope discovery jobs to the buckets and prefixes likely to hold sensitive data, use sampling to inspect a representative subset rather than every object, and schedule full scans less frequently than incremental ones. Macie's automated sampling helps identify where sensitive data lives without scanning everything at full depth.

Controlling Macie cost

Scope discovery to relevant data rather than scanning your entire estate, use sampling to reduce bytes analyzed, avoid re-scanning unchanged data, and focus deep scans on high-risk buckets. As with other volume-billed security tools, aligning what you scan with where the risk is keeps cost proportional to value, the same discipline as GuardDuty.

FAQ

How is AWS Macie priced?

A small per-bucket monthly charge for S3 inventory and access monitoring, plus a per-gigabyte charge for objects analyzed by sensitive-data discovery jobs, tiered so the unit rate falls at volume. The discovery jobs, which inspect object contents, are the main cost driver on large buckets.

How do I reduce Macie cost?

Scope sensitive-data discovery jobs to the buckets and prefixes likely to hold sensitive data rather than your whole estate, use sampling to analyze a representative subset instead of every object, avoid re-scanning unchanged data, and focus deep scans on high-risk buckets. Aligning scanning with risk keeps cost proportional.

What drives Macie cost?

The per-gigabyte sensitive-data discovery charge, since scanning object contents over large buckets adds up. Repeatedly running full discovery across terabytes is the main driver. The per-bucket monitoring charge is small by comparison, so the bytes analyzed by discovery jobs are where cost grows.

Do I need to scan every object with Macie?

No. Macie supports sampling to inspect a representative subset rather than every object, which identifies where sensitive data lives without scanning everything at full depth. Scope jobs to relevant buckets and sample to reduce bytes analyzed, running full deep scans only where and when needed.

Is Macie worth the cost?

For organizations with compliance requirements around sensitive data in S3, generally yes, as automated discovery and monitoring that would be costly to build. Keep it economical by scoping discovery to high-risk data, sampling, and avoiding repeated full scans of your entire estate.

Does C3X estimate Macie cost?

Macie cost is driven by buckets monitored and gigabytes analyzed, which are usage inputs. C3X prices the surrounding S3 infrastructure, and you model your data volume and discovery scope to estimate the sensitive-data-discovery charges.

What to do next

Estimate the infrastructure around your data security before you deploy. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.