I hid fake patient records in S3, then tried to leak them. Here's what AWS caught.
Originally published on AWS Builder Center . A hands-on look at finding sensitive data in S3 before it becomes a breach. Then I built a five-layer safety net around it and tried to break it. 100% fake data. Why I tried this 2026 has been another heavy year for US health data. Two of the biggest incidents: DentaQuest (dental and vision benefits) — about 15 million people notified after a…
In a cloud environment, sensitive patient data can be found and managed using Amazon Macie. This security tool scans files within S3 buckets for any PHI (Protected Health Information) and identifies whether the buckets are public, encrypted, or shared. The objective is to detect and prevent breaches before they occur. In a demonstration, a private bucket was created with Block Public Access enabled and default SSE-S3 encryption.
Four synthetic files were uploaded, containing fake patient records including names, dates of birth, SSN-format numbers, Medicare-format IDs, addresses, phone numbers, and diagnoses. The generator added extra details like fake addresses, phone numbers, and medical conditions for realism. Amazon Macie was then activated in the console, creating a role to access the buckets.
A one-time job was set up to scan the bucket, taking approximately 10 minutes to complete. The first findings were displayed within 4 minutes, flagging the four files as containing sensitive data.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
