Skip to main content

Member Enrollment

The Enrollment page shows all accounts enrolled in Macie and their current enrollment phase. Use it to add new member accounts, retry accounts that failed during enrollment, and remove accounts from Macie.

Accessing Enrollment​

In the Security Hub sidebar, click Amazon Macie > Enrollment.

If Macie has not been set up yet, the page shows an information banner, "Macie is not set up yet for this customer. Complete the setup wizard first to enroll member accounts.", with a Go to setup button that opens the setup wizard.

Configuration Card​

At the top of the page, a card headed Configuration ("Where Macie is administered from and which regions it covers") shows the current Macie configuration:

  • Admin account: the Macie administrator account ID
  • Home region: the Macie home region
  • Linking regions: all regions where Macie is enabled, comma-separated

Progress Bar​

When one or more member accounts are in an active enrollment phase, or the configuration itself is in_progress, a progress bar appears below the Configuration card. The bar polls the server automatically and advances as the job progresses. Its label names the operation in flight, for example "Enrolling members…", "Removing <account-id>…", or "Retrying <account-id> (<region>)…".

Enrolled Accounts​

The Enrolled accounts table ("Accounts running Macie in every linking region") lists all accounts currently enrolled in Macie. A chip in the section header shows the count, for example 12 enrolled. The table has three columns:

ColumnContents
AccountAccount name and ID, plus an admin chip on the administrator account
StatusThe enrollment phase chip, a spinner while the phase is active, and any error text
ActionsRetry, Retry removal and Remove buttons, where they apply

If no accounts are enrolled, the table shows "No accounts enrolled yet" with the hint "Pick accounts from the list below and add them to start collecting Macie posture."

Phase Reference​

Phase chips are rendered in title case:

PhaseColorDescription
PendingGreyEnrollment submitted, waiting to start
EnablingBlueMacie is being enabled in the member account
InvitingBlueInvitation sent to the member account (admin CreateMember + CreateInvitations)
AcceptingBlueAccepting the member association on behalf of the account
EnabledGreenFully enrolled and active
FailedRedEnrollment failed; see the error message below the chip
Removal FailedRedRemoval failed; the account is still in Macie. See the error message below the chip
RemovingAmberRemoval is in progress

There is no Disabled row in this table by design: once every region of an account reaches the disabled phase, the account is treated as not enrolled, drops out of this table, and reappears under Not enrolled so it can be re-enrolled through the normal Add flow.

When a member account spans multiple linked regions, the Status chip shows the worst phase across all regions: any region whose removal failed wins first, then any failed region, then pending, then any active phase. A spinner appears next to the chip while any region is in an active phase. Error messages, when present, appear beneath the status chip in red as region: error text, joined by a bullet when more than one region failed.

The admin account is always listed and cannot be removed or retried, so its Actions cell is empty. It is labelled with an admin chip.

Retrying a Failed Account​

If a non-admin account shows Failed, a Retry button appears in its row.

  1. Click Retry next to the failed account.
  2. Prism replays the enrollment for every region of that account that is currently failed, one region at a time. Each region re-checks the account's permission policy and then re-runs enrollment using the root email already stored for the account.
  3. If a region's retry request itself is rejected, the page reports it as "Retry failed for <region>: <message>" and still refreshes the table, so regions that were successfully re-queued show their new phase.
  4. If the retry fails again, check the error message and verify the root email is correct. See Security Hub Issues for common causes.
note

Retry only ever re-runs enrollment, and it only appears on rows showing Failed. An account whose removal failed shows Removal Failed instead and gets a Retry removal button, so a retry can never re-enable Macie in an account you were removing. See Retrying a Failed Removal.

Retrying a Failed Removal​

If a removal's AWS teardown fails, the account shows Removal Failed rather than Failed, and its row offers Retry removal in place of Retry.

  1. Click Retry removal next to the account.
  2. Prism resumes the removal exactly where it left off, across every region of the account — a Macie removal is account-wide, so one click covers the whole account rather than one region at a time. The account returns to the Removing phase and the progress bar reappears.
  3. On success the account is disassociated and deleted from the administrator account, its own Macie session is disabled, the CKPrism-Macie-Permissions policy is detached, its cached findings and buckets are deleted, and it moves to the Not enrolled table.
  4. If the teardown fails again, the account returns to Removal Failed with the new error text and can be retried again.

Only one removal runs per account at a time: a second Retry removal while one is still in flight is rejected rather than starting a competing teardown. Clicking Remove on such a row does the same work as Retry removal.

Adding Member Accounts​

The Not enrolled table ("Linked accounts that are not yet running Macie") lists every AWS account linked in Prism that is not currently enrolled in Macie.

  1. Select the accounts you want to enroll. Use the header checkbox to select all accounts at once, or check individual rows.
  2. Click Add N to Macie (where N is the number of selected accounts). The button sits in the section header and is disabled until at least one row is selected, so it reads Add 0 to Macie while nothing is picked.
  3. Prism attempts to resolve the root email address for each selected account automatically, in parallel.
    • If all root emails resolve successfully, the accounts are added immediately and appear in the Enrolled accounts table.
    • If any root emails cannot be resolved, the Enter root emails dialog opens.

If every linked account is already enrolled, the table shows "Every linked account is enrolled" with the hint "Nothing left to add — new accounts appear here once they join the organization."

Enter Root Emails Dialog​

The Enter root emails dialog appears when one or more selected accounts could not have their root email address resolved automatically. It explains: "We could not auto-fetch the AWS root email for the accounts below. Enter each account's root email to enroll it in Macie." For each listed account:

  • The account name and ID are shown on the left (just the ID if Prism has no name for it).
  • An editable Root email field is shown on the right. Its helper text carries the reason auto-fetch failed, or the fallback "Auto-fetch failed — enter this account's AWS root email".
  • Enter the account's real AWS root email address.

To find a member account's root email, sign in to that AWS account and go to Account Settings > Account > Email address in the AWS Console.

Add to Macie stays disabled until every listed account has an email typed in. Cancel closes the dialog and discards what you typed; the account selection is left intact.

warning

Macie uses invitation-based member association, which requires each member account's real AWS root email address. An incorrect or placeholder email prevents Prism from inviting the account. Do not use IAM user emails, distribution lists, or aliases.

Removing a Member Account​

The Remove button appears on every non-admin row except those already in the Removing phase.

  1. In the Enrolled accounts table, click Remove next to the account you want to remove.
  2. The Remove account from Macie dialog appears: "Remove <account-id>? Macie in that account will be disabled." Click Remove to confirm, or Cancel to abandon.
  3. The account enters the Removing phase while Prism disassociates and deletes the member from the administrator account in each of its enrolled regions, then disables that account's own Macie session in each of them.

On a clean removal, Prism also detaches the CKPrism-Macie-Permissions policy from that account's access role and deletes its cached findings and bucket rows. The account then disappears from the Enrolled accounts table and reappears in the Not enrolled table so it can be re-enrolled later.

If any teardown step genuinely fails, the account's rows are marked Removal Failed instead of disabled, the configuration rolls up to partial_failure, and the account stays in the Enrolled accounts table with the error text so a still-billable Macie session is never silently left running. In that case the permission policy is not detached and the cached data is retained, because the retry needs both. Use Retry removal on that row to resume the teardown.

warning

Removing an account disassociates it and disables Macie in that account across all linked regions. The admin account cannot be removed; disable Macie from Settings instead.

Live Auto-Polling​

When any account is in an active phase (pending, enabling, inviting, accepting, or removing), the page polls the server automatically and updates the status chips and progress bar without requiring a manual refresh. Polling stops on its own once every account reaches a settled phase.