Check ID: macie_automated_sensitive_data_discovery_enabled
Provider: AWS
Service: macie
Severity: HIGH
Categories: secrets
Resource type: Other

​
What this check verifies

Amazon Macie administrator account has automated sensitive data discovery enabled for S3 data. The evaluation confirms the feature’s status for the account in each Region.

​
Risk

Without continuous discovery, sensitive S3 objects remain unclassified and unnoticed, weakening confidentiality. Over-permissive or public access can persist undetected, enabling data exfiltration and delaying containment and forensic response.

​
Recommendation

Enable and maintain automated sensitive data discovery for the Macie administrator across required Regions. Include relevant buckets, tune identifiers and allow lists to reduce noise, and route findings to monitoring. Complement with least privilege on S3 and defense in depth for data protection.

​
Remediation

aws macie2 update-automated-discovery-configuration —status ENABLED —region <REGION>

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = macie_automated_sensitive_data_discovery_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks