Amazon Macie is enabled

Check ID: macie_is_enabled
Provider: AWS
Service: macie
Severity: MEDIUM
Categories: secrets, forensics-ready
Resource type: Other

Risk

Without active Macie, sensitive data in S3 can remain unclassified and exposed. Misconfigured access and public buckets may go undetected, enabling data exfiltration and secret leakage. This degrades confidentiality and widens breach blast radius by reducing visibility into where sensitive data resides.

Recommendation

Enable and maintain Amazon Macie in all regions hosting S3 data. Use continuous sensitive data discovery, apply custom classifications for your data types, and route findings to monitoring. Enforce least privilege for Macie access and strengthen defense in depth with restrictive bucket policies and access controls.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws macie2 enable-macie —region <REGION>

# Enables Amazon Macie in this region
resource "aws_macie2_account" "main" {
  # Critical: Creating this resource enables Macie for the account in the region
}

# CloudFormation: Enable Amazon Macie in this region
Resources:
  MacieSession:
    Type: AWS::Macie::Session
    Properties:
      Status: ENABLED  # Critical: Enables Macie for the account in this region

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = macie_is_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

Amazon Macie is enabled

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires