In-transit encryption is supported by TLS certificates. And knowing where sensitive information hides in stored data is the starting point for data protection. Today we cover two services — AWS Certificate Manager (ACM) automates TLS certificate issuance, renewal, and deployment, and Amazon Macie detects and classifies sensitive information like PII in S3-stored data via machine learning. The former ensures trust in the encryption channel, the latter ensures visibility of the data itself.