All checks
High
Macie automated sensitive data discovery should be enabled
Checks that Amazon Macie automated sensitive data discovery is enabled in the Region, so Macie samples the S3 buckets there each day and reports where sensitive data such as personal information sits. In an organization, only the Macie administrator can change this for a member account, and this check cannot tell a member from an administrator.
- service
- Macie
- severity
- High
- scope
- evaluated in every region
How to fix it
In the console
Amazon Macie → Settings → Automated sensitive data discovery
- Status
- Enable; an administrator then picks My account or My organization (the CLI's default is every account)
- S3 buckets
- Optionally Edit, then Add buckets to the exclude list to limit what is sampled; this check reads only the status
With the AWS CLI
aws macie2 update-automated-discovery-configuration --status ENABLED --region <region>See which of your accounts this check is failing on.
Book a live scan