A company must detect sensitive personal data stored in S3 and prioritize buckets with potential exposure. Which service is appropriate?

1. IAM Access Analyzer policy generation alone.
2. Amazon Macie with scoped sensitive-data discovery and bucket assessment.
3. Amazon Inspector package scanning on EC2 instances only.
4. VPC Reachability Analyzer alone.