---
title: Amazon Macie Pricing: Why Scanning a 500 GB Bucket Can Cost $500
description: Macie bills two ways: bucket-level evaluation at $0.10 per bucket per month, and sensitive-data discovery at $1.00 per GB inspected. A 500 GB bucket scanned for PII costs $500 just for the discovery; multi-bucket organizations easily hit $10K+ per month. Automated discovery is cheaper than full jobs but compounds across the bucket footprint.
url: https://www.joinhorizon.co/blog/amazon-macie-pricing-bucket-evaluations-sensitive-data/
datePublished: 2026-06-13T00:00:00.000Z
dateModified: 2026-10-28T00:00:00.000Z
author: kevin-w
category: Cost Optimization & FinOps
tags: amazon-macie, macie-pricing, aws-pricing, cost-optimization, finops, security
---
# Amazon Macie Pricing: Why Scanning a 500 GB Bucket Can Cost $500
> Macie bills two ways: bucket-level evaluation at $0.10 per bucket per month, and sensitive-data discovery at $1.00 per GB inspected. A 500 GB bucket scanned for PII costs $500 just for the discovery; multi-bucket organizations easily hit $10K+ per month. Automated discovery is cheaper than full jobs but compounds across the bucket footprint.
import PricingHeroStats from '~/components/blog/PricingHeroStats.astro';
import PricingDimensionTable from '~/components/blog/PricingDimensionTable.astro';
import BillSurpriseCallout from '~/components/blog/BillSurpriseCallout.astro';
import PricingDecisionCard from '~/components/blog/PricingDecisionCard.astro';
Amazon Macie is the AWS sensitive-data classification service for S3. It inspects object content, identifies PII, PHI, credentials, and custom-defined patterns, and produces findings that drive compliance reporting and breach detection. The bill structure has two distinct dimensions: a flat per-bucket evaluation charge that scales with bucket count, and a per-GB discovery charge that scales with the actual data inspected. The discovery line is where most Macie bills land surprisingly high: $1 per GB inspected adds up fast on a multi-TB sensitive-data inventory.
> **Amazon Macie pricing** bills S3 bucket inventory monitoring and sensitive-data discovery jobs per GB scanned. In us-east-1 (June 2026), bucket evaluations cost $0.10 per bucket per month and discovery jobs cost $1/GB inspected, with a one-time 30-day free trial for new accounts. Most surprises come from monthly full-scan jobs on buckets that automated discovery would cover.
| Job type | us-east-1 | Trap |
| ------------------- | ------------------------- | ---------------------- |
| Bucket evaluation | $0.10/bucket/mo | All regions enabled |
| Discovery scan | $1/GB | Monthly full scans |
| Automated discovery | Per-object on new uploads | Cheaper than scheduled |
| Free trial | 30 days, new accounts | Jobs billed past 1 GB |
This post is the bill story. For the operational architecture (finding triage, custom data identifiers, integration with Security Hub), see our [Macie investigation guide](https://www.joinhorizon.co/blog/aws-macie-detective-data-security-investigation/). For the S3 security context, [S3 security best practices](https://www.joinhorizon.co/blog/aws-s3-security-best-practices-preventing-data-exposure/) covers the protective controls that Macie complements.
## The two Macie billing dimensions
_If you only audit one dimension first, replace broad **monthly classification jobs** with automated sensitive-data discovery._
## Why a 500 GB bucket costs $500 to scan
The math is direct: 500 GB × $1/GB = $500 for one full discovery scan. If that scan runs monthly, the bill is $500/month for a single 500 GB bucket. Across an organization with 50 buckets of similar size, each scanned once per quarter, every scan cycle costs $25,000, which averages about $8,300/month.
The cost driver is the actual data volume scanned, not the object count. A bucket with 1 million 1 KB files (1 GB total) costs $1 to scan; a bucket with 100 objects of 5 GB each (500 GB total) costs $500. The per-object overhead is minimal; the per-byte content-inspection cost dominates.
Many compliance programs default to "scan all buckets quarterly." On a multi-TB bucket inventory, this lands at
five-figure monthly Macie bills. Scope quarterly scans to compliance-tracked buckets only (buckets holding regulated
data such as PHI, PII, payment data) and use automated discovery for broader visibility on the rest of the inventory.
## Automated discovery as the cheaper broad-coverage path
_Figure: the two Macie paths in the article. The rows are alternatives. Automated discovery samples the account. A classification job reads the bucket you name. A finding becoming an investigation is an earlier diagram. Rates stay in the article. [Open the draw.io source](https://www.joinhorizon.co/examples/architecture-blog-2026/amazon-macie-pricing-bucket-evaluations-sensitive-data/discovery.drawio)._
Automated sensitive data discovery samples a configurable subset of objects per bucket continuously. The default sampling rate balances cost and coverage; you can tune it per-bucket if specific buckets need higher confidence.
The economics compared to full jobs:
## Custom data identifiers are free at the per-GB rate
Custom data identifiers (regex patterns + keyword proximity rules + character distribution checks for your organization-specific data shapes, such as internal IDs, account number formats, proprietary classifications) are included in the standard per-GB discovery rate. There is no per-identifier surcharge.
This makes Macie cost-effective for organizations with unusual data-classification requirements. Build custom identifiers for your specific patterns; the discovery cost remains the same as the built-in identifiers.
The waste pattern: not using custom identifiers and instead running ad-hoc S3 queries via Athena to find specific patterns. Athena scans all data anyway and provides less structured findings; Macie's per-GB rate covers the same scanning with managed pattern matching plus the integration with Security Hub and EventBridge.
## Multi-region scanning multiplies the bill
_Figure: multi-region scanning in the article. The rows are alternatives. A scan in the home region does not cover buckets in another region. That region needs its own scan. Rates stay in the article. [Open the draw.io source](https://www.joinhorizon.co/examples/architecture-blog-2026/amazon-macie-pricing-bucket-evaluations-sensitive-data/regions.drawio)._
Macie is enabled per region. Data replicated across regions (via S3 Cross-Region Replication or by application-level replication) means the same bytes get scanned multiple times if Macie runs in each region.
The mitigation: scope Macie to the source region. Replicated buckets in secondary regions can rely on the source-region scan results for compliance reporting, since CRR guarantees byte-identical replication. Configure Macie organization-wide with explicit per-region enablement that matches your data-residency posture; don't enable globally by default.
Enable Macie in regions where sensitive data is actually stored or could land. For DR-standby regions with replicated
data, the source-region scan results are equivalent (CRR is byte-identical). For regions that host only build
artifacts, container images, or logs, Macie discovery has little to find. Audit the regional enablement quarterly.
## Bucket-level evaluation compounds per bucket
The $0.10/bucket/month evaluation charge covers bucket-policy review, encryption status, public access checks, and replication configuration. It is small per bucket but compounds at scale: a multi-account organization with 1,000 buckets pays $100/month for evaluation alone.
The line is non-negotiable when Macie is enabled (it is the base "Macie is on" charge). The mitigation is bucket consolidation rather than individual bucket cleanup: fewer buckets, lower evaluation bill. For organizations with bucket sprawl (one bucket per microservice per environment per region), the consolidated-bucket model with prefixes for tenancy reduces the evaluation line proportionally.
## When to use Macie vs alternatives
## A 30-day Macie bill cleanup plan
**Week 1: Job scope audit.** Identify scheduled discovery jobs. For each job with broad bucket scope, narrow to compliance-tracked buckets only. Use automated discovery for broader visibility on non-compliance buckets.
**Week 2: Regional enablement.** Map Macie regional enablement to actual sensitive-data residency. Disable Macie in regions where sensitive data does not land (build artifact regions, log-only regions).
**Week 3: Automated discovery tuning.** Review automated discovery sampling rates per bucket. Increase sampling on buckets that have generated findings; decrease on buckets consistently clean.
**Week 4: Custom identifier review.** Validate that custom data identifiers cover the organization-specific patterns. Add identifiers for internal classifications previously discovered via ad-hoc Athena queries.
## More in this series
Part of the **AWS Service Pricing** series (June 2026).
- Previous: [Part 13](https://www.joinhorizon.co/blog/aws-backup-pricing-vaults-cross-region-restores/)
- Next: [Part 15](https://www.joinhorizon.co/blog/amazon-lightsail-pricing-bundles-vs-ec2-true-total-cost/)
- Browse all: [Cost Optimization & FinOps category](https://www.joinhorizon.co/category/cost-optimization-and-finops/)
## What this post doesn't cover
- **Finding triage workflows:** covered in our [Macie investigation guide](https://www.joinhorizon.co/blog/aws-macie-detective-data-security-investigation/).
- **Detective integration for investigation:** Detective bills independently; covered in our security operations content.
- **Comparison with third-party DLP tools** (Symantec, McAfee MVISION): different operational model, different pricing structure.
- **DataZone classification overlap:** DataZone provides a different classification layer for data lineage; covered separately.
## If you only do one thing this week
Switch from monthly full-scan jobs to automated discovery on most buckets, with scheduled full scans only on buckets that have actually generated findings in the past quarter. Run `aws macie2 list-classification-jobs` to find currently-scheduled jobs; for each, check the bucket scope and the schedule. Replace broad-scope monthly jobs with automated discovery (toggle in the Macie console under Settings → Sensitive data discovery → Automated). The change typically cuts the discovery line by 70 to 90% with no loss of compliance coverage.
For the operational triage of Macie findings, the [Macie investigation guide](https://www.joinhorizon.co/blog/aws-macie-detective-data-security-investigation/) covers the design side.
## FAQ
### Why is Macie sensitive-data discovery $1 per GB?
The $1/GB rate reflects what Macie actually does: extract text from every object, parse the content, run pattern matching against built-in and custom data identifiers (PII, PHI, credentials, custom regexes), and store the findings. The compute cost of doing this at scale across S3 is substantial, since Macie is running a managed text-extraction-and-pattern-matching pipeline. The premium over raw S3 operations reflects the parsing and ML-based classification work. New accounts get a one-time 30-day free trial (discovery jobs are billed past 1 GB during the trial); after that, discovery bills at $1/GB, tiered down at very high volumes.
### How does automated discovery differ from full discovery jobs?
Automated sensitive data discovery samples a small subset of objects per bucket continuously (default sampling rate, configurable). It is cheaper than running a full job that scans every object but provides less coverage. Automated discovery identifies which buckets have sensitive data without quantifying every match. Full discovery jobs scan every object in scope and provide complete inventory but cost the full per-GB rate. The right combination: automated discovery on all buckets for broad coverage, scheduled full jobs on the buckets that automated discovery flagged as containing sensitive data.
### When does Macie actually pay off compared to building custom S3 scanning?
Macie pays off when the alternative is a custom S3-Lambda pipeline that reads each object, runs Comprehend or a custom NLP model, and writes findings. The cost of that pipeline (Lambda invocations + Comprehend API calls + storage) usually exceeds Macie at any meaningful object count. Macie also handles the operational layer (finding deduplication, severity scoring, automatic suppressions on noisy patterns) that the DIY alternative would require building. For compliance-driven sensitive-data inventory, Macie is almost always the right choice.
### Does enabling Macie on every account in my organization multiply the cost?
Yes. Macie is a regional service enabled per account per region. Organization-wide enablement via the Macie organization admin pattern auto-enables Macie on every account-region. The bucket evaluation line ($0.10 per bucket per month) and the discovery line ($1/GB per scanned data) bill per account independently. The 30-day free trial is also per account, which gives a newly enabled account a short window of relief. The mitigation: enable Macie organization-wide as the security posture requires, but scope discovery jobs aggressively per account to keep the bill bounded.
### How do I scope Macie discovery jobs without missing sensitive data?
Use a layered approach. First, automated discovery on all buckets (cheap, broad). When automated discovery flags a bucket as containing sensitive data, schedule a full job on that specific bucket. For data-classification compliance, run quarterly full-scan jobs on buckets in scope of the compliance program (PII storage, customer data, financial records); never run full scans across the entire bucket inventory monthly. Use object-key prefixes in job scope to exclude obviously non-sensitive prefixes (e.g., `logs/`, `temp/`, `static-assets/`).
### Why is my Macie bill higher in certain regions?
Macie pricing is regional but the rates are uniform across most commercial regions. The reason regional bills differ is data location: if your sensitive-data buckets are concentrated in us-east-1, Macie spend concentrates there. Multi-region data replication (S3 Cross-Region Replication) does not avoid the per-region scan cost; if the same data is replicated to three regions and Macie runs in each, the discovery cost is roughly tripled. Scope Macie to the primary region and trust that the replicated data is identical (which is what CRR guarantees).
### What is the relationship between Macie and GuardDuty Malware Protection for S3?
They are complementary, not redundant. Macie classifies objects by content (PII, credit card numbers, healthcare data) and bills per GB inspected for sensitive-data discovery. GuardDuty Malware Protection for S3 scans objects for malware signatures and bills per GB scanned plus per 1,000 objects evaluated. Buckets receiving user-uploaded content typically need both: Malware Protection on every upload, Macie on the buckets storing structured customer data. Configure them on different bucket subsets where possible to avoid paying both rates on the same bytes.
---
*Source: https://www.joinhorizon.co/blog/amazon-macie-pricing-bucket-evaluations-sensitive-data/*