Back to Checks
aws

Macie automated sensitive data discovery is enabled

macie_automated_sensitive_data_discovery_enabled
Service: macieSeverity: high
OfficialBuilt-inVerified
Categories:secrets
Resource Type:Other

Amazon Macie administrator account has automated sensitive data discovery enabled for S3 data. The evaluation confirms the feature's status for the account in each Region.

Prowler logoProwlerprowler-provider-aws

Risk

Without continuous discovery, sensitive S3 objects remain unclassified and unnoticed, weakening confidentiality. Over-permissive or public access can persist undetected, enabling data exfiltration and delaying containment and forensic response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks macie_automated_sensitive_data_discovery_enabled

Recommendation

Enable and maintain automated sensitive data discovery for the Macie administrator across required Regions. Include relevant buckets, tune identifiers and allow lists to reduce noise, and route findings to monitoring. Complement with least privilege on S3 and defense in depth for data protection.

Remediation

CLI

aws macie2 update-automated-discovery-configuration --status ENABLED --region <REGION>

Other

1In the AWS Console, open Amazon Macie
2Select the correct Region from the Region selector
3Go to Settings > Automated sensitive data discovery
4Click Enable under Status (choose My account if prompted)
5Repeat in other Regions where Macie is enabled if needed

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.macie.macie_client import macie_client


class macie_automated_sensitive_data_discovery_enabled(Check):
    def execute(self):
        findings = []
        for session in macie_client.sessions:
            if session.status == "ENABLED":
                report = Check_Report_AWS(metadata=self.metadata(), resource=session)
                report.resource_arn = macie_client._get_session_arn_template(
                    session.region
                )
                report.resource_id = macie_client.audited_account
                report.status = "FAIL"
                report.status_extended = "Macie is enabled but it does not have automated sensitive data discovery."

                if session.automated_discovery_status == "ENABLED":
                    report.status = "PASS"
                    report.status_extended = (
                        "Macie has automated sensitive data discovery enabled."
                    )

                findings.append(report)

        return findings

References