[Yandex Cloud documentation](../../../index.md) > [Yandex Object Storage](../../index.md) > [Step-by-step guides](../index.md) > Buckets > Searching for sensitive data in a bucket

# Searching for sensitive data in a bucket

{% note info %}

This feature is at the [Preview](../../../overview/concepts/launch-stages.md) stage.

{% endnote %}

[Data Security Posture Management](../../../security-deck/concepts/dspm.md) scans [buckets](../../concepts/bucket.md) for [sensitive information](../../concepts/sensitive-data-search.md) in storage. You can create bucket scans and manage scan results in Object Storage via the [management console](https://console.yandex.cloud).


## Getting started {#before-begin}

Make sure the [service account](../../../iam/concepts/service-control.md#service-agent) you will use to scan a bucket and work with scan results has the following roles:

* [`dspm.editor`](../../../security-deck/security/dspm-roles.md#dspm-editor) or higher: Required to create scans.
* [`dspm.admin`](../../../security-deck/security/dspm-roles.md#dspm-admin) or [`dspm.viewer`](../../../security-deck/security/dspm-roles.md#dspm-viewer) or higher: Required to view scan results with masked or public data, respectively.
* [`dspm.viewer`](../../../security-deck/security/dspm-roles.md#dspm-viewer) or higher: Required to download scan results.
* [`dspm.viewer`](../../../security-deck/security/dspm-roles.md#dspm-viewer) or higher: Required to export results. Also the service account that will perform the export must have write permissions for the target bucket.

## Creating a {#create} scan

{% note tip %}

The Object Storage UI allows you to scan individual buckets for sensitive data. To monitor data in multiple buckets at the folder, cloud, or organization level, use the [DSPM](../../../security-deck/concepts/dspm.md) module inside [Yandex Security Deck](../../../security-deck/index.md).

{% endnote %}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select a folder.
  1. Navigate to **Object Storage**.
  1. Click the name of the bucket you want to create a scan for.
  1. Go to the **Security** → **Sensitive data search** tab.
  1. Click **New scan**.

      {% note info %}

      If access to the bucket is controlled by a [policy](../../security/policy.md#conditional-writes-policy), allow access to Security Deck IP addresses in the bucket policy settings. For a list of addresses, see [Public IP address ranges](../../../overview/concepts/public-ips.md#security-deck-ips).

      {% endnote %}

  1. Under **Sensitive data search**, select the [data categories](../../../security-deck/concepts/dspm.md#data-source) to scan for. You can select all the available categories at once or any combination of them.

  1. Optionally, under **Include files into the scope**, specify the [object keys](*bucket-object-key) or [prefixes](*bucket-object-prefix) to include in the scan. By default, the scan targets all supported file formats.

      {% note info %}

      Currently, you cannot scan objects encrypted with a [KMS key](../../../kms/concepts/key.md).

      {% endnote %}

  1. Click **Create scan**.

  The scan will start automatically. To repeat the scan, click **Repeat scan**.

{% endlist %}


## Viewing scan results {#view}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select a folder.
  1. Navigate to **Object Storage**.
  1. Click the name of the bucket in question.
  1. Go to the **Security** → **Sensitive data search** tab.
  1. Sensitive data found during the scan, if any, will be displayed on the **Results** tab. The information about each detected object is presented in the following columns:

      * `Data type`: Search category of the data, e.g., `FULL-NAME-RU-ML`: Full name.
      * `Found occurrence`: Sensitive data found.
      * `Object`: Path to the file the data was found in.

{% endlist %}


## Downloading scan results {#download}

As you download, a CSV file with the scan results is saved locally on your computer.

{% note info %}

The file can contain a maximum of 10,000 sensitive data records. To export a larger number of records, use [export](#export) to Object Storage.

{% endnote %}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select a folder.
  1. Navigate to **Object Storage**.
  1. Click the name of the bucket in question.
  1. Navigate to the **Security** → **Sensitive data search** tab.
  1. Click ![image](../../../_assets/console-icons/chevron-down.svg) **More** → **Download results**.
  1. In the window that opens, specify how to display names, contact information, and other personal data, then click **Download file**.

{% endlist %}


## Exporting scan results {#export}

When exporting, the file with scan results is saved to the bucket you select.

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select a folder.
  1. Navigate to **Object Storage**.
  1. Click the name of the bucket in question.
  1. Navigate to the **Security** → **Sensitive data search** tab.
  1. Click ![image](../../../_assets/console-icons/chevron-down.svg) **More** → **Export to bucket**.
  1. In the window that opens, set the export settings:

      * In the **Bucket** field, select the bucket to save the results to.
      * In the **Path to bucket** field, set the [prefix](../../concepts/object.md#folder) of the object to save the results to.
      * In the **File name** field, specify the name of the file to save the results to. The file will automatically get the `.csv` extension.
      * In the **Service account** field, select the service account with the `storage.uploader` [role](../../../iam/concepts/access-control/roles.md) for the selected bucket and `kms.keys.encrypter` for the [encryption key](../../../kms/concepts/key.md), if the bucket is [encrypted](../../concepts/encryption.md).
      * Under **Display sensitive data**, specify how to display names, contact information, and other personal data.
      * Click **Export** to export the parameter check results.

{% endlist %}


## Viewing scan errors {#errors}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select a folder.
  1. Navigate to **Object Storage**.
  1. Click the name of the bucket in question.
  1. Navigate to **Security** → **Sensitive data search** → **Messages and errors**.

{% endlist %}

For more information about scanning errors, see [Troubleshooting Data Security Posture Management (DSPM)](../../../security-deck/diagnostics/dspm-diagnostics.md).

[*bucket-object-key]: An [object key](../../concepts/object.md#key) is the full name of a file within a bucket, often formatted as a filesystem path. Here are some examples of keys: `docs/reports/2026/april.pdf`, `photos/trips/paris/img001.jpg`.

[*bucket-object-prefix]: A prefix is the initial part of a key displayed in the UI as a folder. Here are some examples of prefixes: `photos/`, `photos/trips/`, `photos/trips/paris/`.