Macie

Amazon Macie in Prism centralizes S3 data-security posture and sensitive-data discovery across every AWS account in your organization. From a single interface, you can see which S3 buckets are public, unencrypted, or shared externally, browse policy and sensitive-data findings by severity, manage which accounts are enrolled, and opt in to automated sensitive-data discovery.

What is Macie?

Amazon Macie is a data security service that discovers sensitive data in Amazon S3 and reports on the security and access posture of your S3 buckets. Prism deploys Macie centrally using the invitation model: one account you designate acts as the Macie administrator and aggregates the S3 bucket inventory and findings from all enrolled member accounts across every linked region, without configuring Macie account by account.

Key capabilities include:

• Centralized S3 data-security posture, One administrator account aggregates the S3 bucket inventory (public access, encryption, sharing) from every enrolled member account across all linked regions
• Policy and sensitive-data findings, Browse both POLICY findings (posture issues such as a bucket becoming public) and CLASSIFICATION findings (sensitive data detected in objects), ranked by severity
• Severity dashboard, Three severity tiles (High, Medium, Low) summarize your active (non-archived) finding count at a glance, with drill-down to matching findings, alongside four S3 bucket-posture tiles
• S3 bucket inventory, A posture table of every monitored bucket with Bucket, Account, Region, Public access, Encryption, Shared access, Objects, Size, and Sensitivity columns
• Opt-in automated discovery, Turn on automated sensitive-data discovery (off by default) to have Macie continually sample and score your S3 data
• Prism-local archive workflow, Archive findings in Prism to remove them from your active count; unarchive at any time (archive state is local to Prism, see below)
• Standing, enumerated permissions, Prism attaches a named IAM policy, CKPrism-Macie-Permissions, to each enrolled account's access role, and the Permissions tab in Settings scans every account and offers a Fix roles action when one drifts

Navigation

The Macie section is accessible from the Security Hub sidebar under Amazon Macie. It has five areas:

Sidebar item	Description
Dashboard	Severity tiles, S3 bucket-posture tiles, Top finding types, and Per-account findings
S3 buckets	Posture inventory of every monitored S3 bucket with filters
Findings	Browse, filter, and archive Macie policy and sensitive-data findings
Enrollment	Add, remove, and retry member accounts
Settings	Manage automated discovery, linking regions, account permissions, and disable Macie

When Macie has not been configured yet, the sidebar shows a single Enable Amazon Macie row instead of the dashboard and sub-pages. Clicking it opens the setup wizard. Macie also appears on the Security Hub Overview and in Configuration > Capabilities as a card headed Data security (labelled macie), with an Enable button.

info

Macie enrollment uses invitation-based member association, which requires the real AWS root email address of each member account. Prism resolves most root emails automatically; for accounts where auto-resolution fails, you enter the address manually. See Enrollment and Security Hub Issues for details.

warning

Archiving a Macie finding is a Prism-local action. Amazon Macie has no per-finding archive API, so archiving only sets a flag in Prism's database, it does not change anything in AWS Macie. Archived findings are labelled Archived (Prism) and can be unarchived at any time. A findings refresh never overwrites your local archive state.

Cost & Billing

Enabling Macie has ongoing AWS costs that scale with your S3 footprint:

• Bucket inventory (per bucket), When Macie is enabled it evaluates every S3 bucket in each enrolled account and region for public-access, encryption, and sharing posture. AWS charges an ongoing monthly fee per S3 bucket that Macie monitors, independent of automated discovery. Cost scales with the number of buckets across enrolled accounts and linked regions.
• Automated sensitive-data discovery (per GB), Automated discovery is off by default. When enabled, Macie continually samples and analyses S3 objects to compute sensitivity scores and produce sensitive-data findings, and AWS bills this per GB of data analysed. Enabling it across many large buckets can incur significant cost. See Settings and the Discovery step of the setup wizard.

Prerequisites

Before using Macie, ensure the following:

• Your organization has been onboarded to Prism by CloudKeeper
• Security Hub has been enabled for your organization as a beta feature by CloudKeeper
• Security Hub access enabled for your account by an Admin in Preferences > Admin Management
• At least one AWS account is onboarded in Prism to serve as the Macie administrator

Related Pages

• Enabling Macie, Run the six-step setup wizard
• Dashboard, Read the severity and bucket-posture tiles
• S3 buckets, Review the bucket posture inventory
• Findings, Browse, filter, and archive Macie findings
• Enrollment, Manage which accounts are enrolled
• Settings, Manage automated discovery, regions, account permissions, and disable Macie
• Configuration, Enable Macie as an additional engine after another engine is already live
• Security Hub Issues, Troubleshooting enrollment, findings, and setup failures