Skip to main content

Dashboard

The Dashboard is the landing page for Macie after setup completes. It shows a severity-based summary of all active (non-archived) findings across your enrolled accounts and regions, a snapshot of your S3 bucket posture, and controls to refresh both findings and the bucket inventory.

Accessing the Dashboard​

In the Security Hub sidebar, expand Amazon Macie and click Dashboard. If Macie is enabled, that is where the section opens. The page header reads Macie Dashboard.

The header subtitle is one line, reading Admin account <id> • Home region <region> • Findings: <when> • Buckets: <when>:

  • Admin account: the Macie administrator account ID
  • Home region: the Macie home region
  • Findings: how long ago the last successful findings refresh ran (for example, "5 min ago"); shows "never" before the first refresh
  • Buckets: how long ago the last successful bucket-inventory refresh ran; shows "never" before the first refresh

An Automated discovery on chip is appended to the line while automated sensitive-data discovery is enabled; it is absent when discovery is off. Turn it on from Settings.

Severity Cards​

Three severity cards summarize your non-archived finding counts:

CardColorMeaning
HighOrangeHigh severity active findings
MediumAmberMedium severity active findings
LowBlueLow severity active findings

Each card's caption reads active findings (or active finding for a count of one), and a line beneath the row totals them: Total active findings across all severities.

Click any card to open the Findings page pre-filtered to that severity level.

info

Severity counts reflect non-archived findings only. Findings archived in Prism are excluded from all three cards. Macie findings use only the High, Medium, and Low severity levels.

Top Finding Types​

The Top finding types table, subtitled Where Macie is raising the most findings, lists up to ten Macie finding types with the most active findings across your organization, highest count first, alongside the count for each. A chip in the section header reads N types for the number of rows shown. Types include both POLICY findings (posture issues, for example Policy:IAMUser/S3BucketPublic) and CLASSIFICATION findings (sensitive data detected, for example SensitiveData:S3Object/Personal).

Click any row to open the Findings page pre-filtered to that finding type.

If no findings have been ingested since the last refresh, the table shows an empty state reading No findings detected yet — Run “Refresh findings” to pull the latest Macie results from AWS.

Per-Account Findings​

The Per-account findings table, subtitled Active Macie findings by enrolled account, lists each enrolled account that has at least one active finding and the total finding count for that account, highest count first. Accounts are identified by account ID. A chip in the section header reads N accounts with findings.

Click any row to open the Findings page pre-filtered to that account.

When no account has an active finding, the table reads No accounts with active findings — Enrolled accounts appear here as soon as Macie reports a finding for them.

S3 Bucket Posture​

Below the findings breakdowns, a bucket-posture stat row summarizes the S3 bucket inventory aggregated by the last bucket refresh. Each tile is captioned buckets (or bucket for a count of one):

StatMeaning
S3 bucketsNumber of S3 buckets monitored across all enrolled accounts and linked regions
Publicly accessibleBuckets whose effective permissions allow public access (public access PUBLIC)
UnencryptedBuckets with no default encryption configured (encryption type NONE)
Shared externallyBuckets shared with an AWS account outside your organization (shared access EXTERNAL)

The last three tiles open the S3 Buckets page pre-filtered to that posture; S3 buckets opens the same page unfiltered.

Refreshing​

Prism does not pull Macie data in real time. There are two independent refresh kinds, each with its own button in the header:

RefreshWhat it ingests
Refresh findingsIngests up to 50,000 active (non-archived) policy and sensitive-data findings from the admin account across all linked regions
Refresh bucketsRe-scans the S3 bucket posture inventory (DescribeBuckets) across all linked regions, upserting bucket rows and pruning buckets that are no longer present
  1. Click Refresh findings or Refresh buckets in the header. Hovering them reads Fetch the latest findings from AWS and Re-scan S3 bucket posture from AWS respectively.
  2. A progress bar appears below the header while that job runs, naming the region currently being scanned.
  3. When the job finishes, the affected cards and tables update automatically.

Each refresh button is disabled while a job of that kind is already in progress, reads Refreshing…, and its tooltip changes to Findings refresh already in progress or Bucket refresh already in progress. Only one findings job and one bucket job can run at a time, but the two kinds are independent of each other. A refresh that is still running when you navigate away or reload is picked up again when you return to this page.

note

The findings refresh ingests up to 50,000 active findings per run and preserves your Prism-local archive state (an archived finding stays archived when re-ingested). Findings that Macie flags as samples are ingested alongside real findings.

Partial Failure Banner​

If Macie setup succeeded for some member accounts but failed for others, a warning banner reading Macie setup partially failed, followed by the reason AWS reported, appears above the severity cards. Click the Review button in the banner to open the Enrollment page, where you can see which accounts failed and retry them.