Back to Checks
aws

Amazon Macie is enabled

macie_is_enabled
Service: macieSeverity: medium
OfficialBuilt-inVerified
Categories:secretsforensics-ready
Resource Type:Other

Amazon Macie status is assessed per region with S3 presence to determine if sensitive data discovery is operational. The outcome reflects whether Macie is active or in a PAUSED/not enabled state for the account and region.

Prowler logoProwlerprowler-provider-aws

Risk

Without active Macie, sensitive data in S3 can remain unclassified and exposed. Misconfigured access and public buckets may go undetected, enabling data exfiltration and secret leakage. This degrades confidentiality and widens breach blast radius by reducing visibility into where sensitive data resides.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks macie_is_enabled

Recommendation

Enable and maintain Amazon Macie in all regions hosting S3 data. Use continuous sensitive data discovery, apply custom classifications for your data types, and route findings to monitoring. Enforce least privilege for Macie access and strengthen defense in depth with restrictive bucket policies and access controls.

Remediation

CLI

aws macie2 enable-macie --region <REGION>

Terraform

# Enables Amazon Macie in this region
resource "aws_macie2_account" "main" {
  # Critical: Creating this resource enables Macie for the account in the region
}

NativeIaC

# CloudFormation: Enable Amazon Macie in this region
Resources:
  MacieSession:
    Type: AWS::Macie::Session
    Properties:
      Status: ENABLED  # Critical: Enables Macie for the account in this region

Other

1Sign in to the AWS Management Console and switch to the target region
2Open Amazon Macie
3Click Get started or Enable Macie
4If Macie shows Suspended/Paused, click Resume Macie
5Repeat in each region with S3 buckets as needed

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.macie.macie_client import macie_client
from prowler.providers.aws.services.s3.s3_client import s3_client


class macie_is_enabled(Check):
    def execute(self):
        findings = []
        for session in macie_client.sessions:
            report = Check_Report_AWS(metadata=self.metadata(), resource=session)
            report.resource_arn = macie_client._get_session_arn_template(session.region)
            report.resource_id = macie_client.audited_account
            if session.status == "ENABLED":
                report.status = "PASS"
                report.status_extended = "Macie is enabled."
                findings.append(report)
            else:
                if (
                    macie_client.provider.scan_unused_services
                    or session.region in s3_client.regions_with_buckets
                ):
                    if session.status == "PAUSED":
                        report.status = "FAIL"
                        report.status_extended = (
                            "Macie is currently in a SUSPENDED state."
                        )
                    else:
                        report.status = "FAIL"
                        report.status_extended = "Macie is not enabled."
                    findings.append(report)

        return findings

References