S3 Buckets

The S3 Buckets page shows the posture inventory of every S3 bucket Macie monitors across your enrolled accounts and linked regions. Use it to find public, unencrypted, or externally shared buckets and to review each bucket's sensitivity score.

Accessing S3 Buckets

In the Security Hub sidebar, click Amazon Macie > S3 buckets. You can also reach this page pre-filtered by clicking a bucket-posture stat on the Dashboard. The page header reads S3 bucket posture.

info

The bucket inventory shows results from the last bucket refresh, not live AWS data. If the list appears stale, run Refresh buckets from the Dashboard.

Bucket Table

The table is headed Buckets, subtitled Every S3 bucket Macie has inventoried for the enrolled accounts, with an N buckets chip giving the number of rows currently shown. Each row represents one monitored S3 bucket:

Column	Description
Bucket	The S3 bucket name
Account	The account name followed by the AWS account ID that owns the bucket, as Name (123456789012). When Prism holds no name for the account, the ID is shown on its own — the same fallback the Enrollment page uses
Region	The AWS region the bucket is in
Public access	A chip reading PUBLIC, NOT PUBLIC, or UNKNOWN — whether the bucket's effective permissions allow public access. A bucket with no value recorded is shown as UNKNOWN
Encryption	Two stacked chips. The first carries the bucket's default encryption type as reported by Macie: AES256, aws:kms, aws:kms:dsse, None, or UNKNOWN (see Encryption Type). The second reports whether the bucket policy requires encryption on upload (see Upload Policy)
Shared access	A chip reading EXTERNAL, INTERNAL, NOT SHARED, or UNKNOWN — whether the bucket is shared outside your organization. A bucket with no value recorded is shown as UNKNOWN
Objects	The object count Macie recorded for the bucket
Size	The total storage size of the bucket, in B/KB/MB/GB/TB/PB
Sensitivity	Macie's automated sensitive-data sensitivity score for the bucket (see below)

Rows are ordered by account, then by bucket name. The whole inventory is returned at once, so there is no paging control and no Load more button on this page. Rows are not clickable.

When nothing matches, the table reads No buckets match these filters — Clear a filter, or run “Refresh buckets” on the dashboard to populate posture. The same message covers an inventory that has never been populated, so if you have not yet run a bucket refresh, run Refresh buckets from the Dashboard before assuming a filter is at fault.

Encryption Type

The first chip in the Encryption column is the bucket's default encryption type, exactly as Macie reported it.

Chip	Meaning
AES256, aws:kms, aws:kms:dsse	The bucket has default encryption configured with that method. Drawn in the reassuring colour
None	Macie measured the bucket and found no default encryption configured. Drawn in the warning colour — objects can sit in this bucket unencrypted at rest
UNKNOWN	Macie did not report an encryption type for this bucket. Drawn in a neutral colour, with a tooltip

caution

UNKNOWN encryption is unmeasured, not safe. It is its own state, in its own neutral colour, for the same reason Upload policy UNKNOWN below is — "Macie could not tell" is not "this bucket is encrypted", and reading an unmeasured encryption control as reassuring is the one mistake worth guarding against here. Buckets cached before Prism began recording this signal also read UNKNOWN until the next Refresh buckets run.

The Encryption filter offers None, AES256, aws:kms, and aws:kms:dsse, but no UNKNOWN option — unlike Public access and Shared access, unmeasured buckets cannot be isolated with that dropdown. Read the column instead, or narrow the list with the other filters first.

Upload Policy

The second chip in the Encryption column reports whether the bucket's policy requires encryption on upload. It answers a different question from the encryption-type chip above it: the type chip describes how the objects already in the bucket are encrypted, while this one describes whether the policy lets a new object in without encryption. The two are not derivable from each other — a bucket can report AES256 and still accept plaintext uploads — so read them together.

Chip	Meaning
Unencrypted uploads allowed	The bucket policy does not require encryption on upload. An object can be written to this bucket unencrypted, whatever the default encryption type says. This is the notable case, and it is the only one drawn in the same alarm colour the Public access column gives PUBLIC
Uploads must be encrypted	The bucket policy rejects an upload that does not specify encryption
Upload policy UNKNOWN	Macie could not determine whether the bucket's policy requires encryption on upload

Hovering any of the three shows the same explanation as a tooltip.

caution

Upload policy UNKNOWN is its own state, not a quieter way of saying the policy blocks unencrypted uploads. It means Macie could not tell, so treat it as unmeasured rather than safe. Buckets cached before Prism began recording this signal also show UNKNOWN until the next Refresh buckets run; if a whole inventory reads UNKNOWN, refresh it before drawing any conclusion.

There is no filter for this signal — narrow the list with the other filters, or with Search buckets, and read the column.

Sensitivity Score

The Sensitivity column reflects Macie's automated sensitive-data discovery score for the bucket.

• A dash (-) means Macie has not computed a score — the value is absent or negative. This is the case when automated discovery is off, or when discovery is on but the bucket has not yet been analysed.
• With automated discovery on, a higher score indicates that more sensitive data was detected in the bucket (weaker data-security posture).

info

Sensitivity scores are only populated when automated sensitive-data discovery is enabled (it is off by default, and billed per GB of data analysed). Enable it from Settings or during the setup wizard. Without discovery, this page still shows the full public-access, encryption, and sharing posture for every bucket.

Filtering

Use the filter controls above the table to narrow the list, in this order:

• Account: a searchable dropdown listing your accounts as Name (123456789012), or as the ID alone when Prism holds no name, showing All accounts while nothing is selected. This list is every account Prism knows about for the realm, not only the ones enrolled in Macie, so an account with no inventory yet is still offered
• Public access: All, PUBLIC, NOT PUBLIC, or UNKNOWN
• Shared access: All, EXTERNAL, INTERNAL, NOT SHARED, or UNKNOWN
• Encryption: All, None, AES256, aws:kms, or aws:kms:dsse — there is no UNKNOWN option here (see Encryption Type)
• Search buckets: free-text search against the bucket name

Every filter is single-select; picking All clears one of the three dropdowns, and the account picker is cleared with its own clear button. The filters are reflected in the page URL — which is how the Dashboard's posture tiles deep-link here — so a filtered view can be shared or bookmarked. Typing into Search buckets re-queries shortly after you stop typing rather than on every keystroke.

Refreshing the Inventory

The bucket inventory is populated by the Refresh buckets job on the Dashboard. Each refresh re-scans every linked region, upserts each bucket's posture, and prunes buckets that are no longer present in AWS.

note

Enabling Macie evaluates every S3 bucket in each enrolled account and region for its posture. AWS charges an ongoing monthly fee per S3 bucket that Macie monitors, independent of automated discovery. Cost scales with the number of buckets across your enrolled accounts and linked regions.

note

The inventory is scanned one linked region at a time. If a region cannot be read (for example, before permissions have propagated, or while AWS is throttling), that region is skipped and its previously known buckets are left in place rather than deleted, and the refresh still completes rather than failing. Re-run Refresh buckets after enrollment settles.

Related Pages

• Dashboard, Bucket-posture stat row and refresh controls
• Findings, Policy and sensitive-data findings for these buckets
• Settings, Enable automated discovery to populate sensitivity scores
• Security Hub Issues, Troubleshooting stale inventory and refresh problems