[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[],[],null,["# Sensitive data discovery for Amazon S3\n\nThis page describes Sensitive Data Protection discovery for use with\nAmazon S3. This feature is available only to customers who have\n[activated Security Command Center at the Enterprise\ntier](/security-command-center/docs/activate-enterprise-tier).\n\nSensitive Data Protection discovery helps you learn about the types\nof data that you're storing in S3 and the sensitivity\nlevels of your data. When you profile your S3 data, you\ngenerate *file store data profiles*, which provide insights and metadata about\nyour S3 buckets. For each S3 bucket,\na file store data profile includes the following information:\n\n- The types of files that you're storing in the bucket, categorized into [file\n clusters](/sensitive-data-protection/docs/supported-file-types#file_clusters)\n- The sensitivity level of the data in the bucket\n- A summary about each detected file cluster, including the types of sensitive information found\n\nFor a full list of insights and metadata in each file store data profile, see\n[File store data\nprofiles](/sensitive-data-protection/docs/metrics-reference#file-store-data-profile).\n\nFor more information about the discovery service, see [Data\nprofiles](/sensitive-data-protection/docs/data-profiles).\n\nWorkflow\n--------\n\nThe high-level workflow for profiling Amazon S3 data is as follows:\n\n1. In Security Command Center, [create a connector for Amazon Web Services\n (AWS)](/security-command-center/docs/connect-scc-to-aws). Make sure that you\n select the **Grant permissions for Sensitive Data Protection discovery**\n checkbox and follow the instructions to configure the connector with\n sensitive data discovery permissions.\n\n If you already have a connector that doesn't have **Grant permissions for\n Sensitive Data Protection discovery** selected, see [Grant sensitive data\n discovery permissions to an existing AWS\n connector](/security-command-center/docs/connect-scc-to-aws#grant-sdp-permissions-existing-connector).\n2. [Create an inspection\n template](/sensitive-data-protection/docs/creating-templates-inspect#create_a_new_inspection_template)\n in the `global` region or the region where you plan to store the discovery\n scan configuration and all generated data profiles.\n\n3. [Create a discovery scan configuration for Amazon S3](/sensitive-data-protection/docs/profile-amazon-s3).\n\n Sensitive Data Protection profiles your data according to the schedule\n that you specify.\n\nPricing\n-------\n\nWhen you profile Amazon S3 data, AWS charges you for [requests that\nSensitive Data Protection makes](#requests-to-amazon) and for [data transfers\nfrom S3 to the internet](#data-transfers-from-amazon-s3).\n\nWhen the discovery service profiles your data, it scans a sample of the data in\nyour S3 bucket. Discovery uses heuristic methods to\ndetermine how much data to sample in each bucket and within specific files. In\nthis process, some data is transferred to Google Cloud and inspected using\nthe [content inspection\nservice](/sensitive-data-protection/docs/concepts-method-types#content-methods) of\nSensitive Data Protection. In most cases, if there are no intermittent errors,\nthe data transferred and scanned for each bucket does not exceed 30 GB. The data\nsampled for each bucket can be less than 30 GB.\n\n### Requests from Sensitive Data Protection\n\nSensitive Data Protection performs the following operations in the process of\nprofiling your S3 buckets:\n\n- Around 50 `LIST` requests per day per profiled S3 bucket.\n- Around 4 `GET` requests per file for up to 7,000 files in a profiled bucket. Sensitive Data Protection generally makes under 100,000 `GET` calls. Don't rely on this value when optimizing for cost; this value might change in the future.\n\nThe price that AWS charges per 1,000 requests differs based on the region of the\nS3 bucket. For more information, see *Requests \\& data\nretrievals* in the [Amazon S3 pricing\ndocumentation](https://aws.amazon.com/s3/pricing/).\n\n### Data transfers from S3 to the internet\n\nWhen Sensitive Data Protection profiles S3 data, the\ndata is considered to be transferred from S3 to the\ninternet. AWS charges may apply. For more information, see *Data Transfer OUT\nFrom Amazon S3 To Internet* in the [Amazon S3 pricing\ndocumentation](https://aws.amazon.com/s3/pricing/).\n\n### Example calculations\n\nSuppose that you want to profile 10 S3 Standard buckets in the US East (N.\nVirginia) region. You can estimate the Amazon costs that are directly related to\nthe discovery operation as follows.\n| **Important:** These rates are provided for illustration purposes only. You are responsible for calculating your Amazon costs using the latest rates and pricing policies in the Amazon pricing documentation.\n\n#### Example: Requests and data retrievals\n\n#### Example: Data transfer out from Amazon S3 to the internet\n\nData residency considerations\n-----------------------------\n\nConsider the following when you plan to profile data from\nother cloud providers:\n\n- The data profiles are stored alongside the discovery scan configuration. In contrast, when you profile Google Cloud data, the profiles are stored in the same region as the data to be profiled.\n- If you store your inspection template in the `global` region, an in-memory copy of that template is read in the region where you store the discovery scan configuration.\n- Your data is not modified. An in-memory copy of your data is read in the region where you store the discovery scan configuration. However, Sensitive Data Protection makes no guarantees about where the data passes through after it reaches the public internet. The data is encrypted with SSL.\n\nWhat's next\n-----------\n\n- [Profile Amazon S3 data](/sensitive-data-protection/docs/profile-amazon-s3)"]]
