Data loss prevention (DLP) has been challenging for many organizations to implement in the cloud, primarily because of a lack of solutions and difficulty integrating with the cloud provider’s APIs.
That has significantly changed in the past several years, however. In addition to tools like Amazon Macie as a cloud-native option, quite a few third-party providers have added products and services in the AWS Marketplace to offer DLP (usually through the implementation of a virtual gateway appliance), as well as host-based DLP agents that can be installed into workloads and images, reporting back to a central monitoring and policy platform also deployed in the cloud environment.
Implementing DLP is a subjective decision depending on whether your organization is subject to internal or compliance-related requirements that may necessitate this particular control.