Skip to main content

Settings

The Settings page lets you toggle automated sensitive-data discovery, change the regions where Macie is enabled, check and repair the IAM permissions Prism needs in each enrolled account, and disable Macie entirely. Changes to regions and disabling trigger an asynchronous job.

The page has four tabs, in this order: Discovery, Regions, Permissions, and Danger zone.

Accessing Settings​

In the Security Hub sidebar, click Amazon Macie > Settings.

If Macie has not been set up yet, the page shows an information banner, "Macie is not set up yet for this customer. Complete the setup wizard first to manage discovery, regions, or disable the service.", with a Go to setup button that opens the setup wizard.

Discovery Tab​

The Discovery tab, headed Automated discovery, controls automated sensitive-data discovery across your enrolled accounts.

  • A single toggle, Enable automated sensitive-data discovery, turns it on or off. It is off by default.
  • When enabled, Macie continually samples and analyses S3 objects to compute per-bucket sensitivity scores and produce sensitive-data (CLASSIFICATION) findings.

Set the toggle and click Save discovery setting. Prism records the new setting and returns you to the Macie Dashboard; the change is then applied in the background, per region, to the admin account plus every member account currently in the Enabled phase. Accounts that are failed or mid-enrollment are skipped until they settle.

Unlike a region change or a disable, saving the discovery setting does not put the configuration into in_progress, so there is no progress bar for it. If part of the rollout fails, the problem is appended as a note to the configuration's message rather than failing anything; save the setting again to retry.

note

Discovery can only be changed while Macie is fully settled. If the configuration is mid-operation, the save is rejected with "Macie must be fully enabled before changing auto-discovery" — wait for the operation in flight to finish and try again.

warning

Automated sensitive-data discovery is billed per GB of data analysed. Across many large buckets it can incur significant cost. Leaving it off still gives you the full S3 bucket posture inventory and policy findings; turn it on only when you understand the per-GB billing implications. Until discovery is on and buckets have been analysed, the Sensitivity column on the S3 Buckets page shows a dash for every bucket.

Regions Tab​

The Regions tab, headed Linking regions, lets you add or remove the regions where Macie is enabled.

  • Home region: shown as a read-only line, "Home region: <region> (read-only)". It cannot be removed.
  • Linking regions: a multi-select list of all available AWS regions. The home region is locked into the selection and cannot be deselected.

Update your region selection and click Save regions to apply the changes. Prism returns you to the Macie Dashboard, which shows the "Updating linking regions…" progress screen while the job runs.

What Adding or Removing a Region Does​

OperationEffect
Adding a regionMacie is enabled in that region for the admin account, then the admin plus every member account currently Enabled in at least one region is enrolled in the new region
Removing a regionMacie sessions and member associations in that region are torn down, and findings and bucket inventory stored for that region are pruned from Prism

An account whose rows are Failed is deliberately not carried into a newly-added region, so a failed removal is never quietly re-enrolled somewhere new.

warning

Removing a region is destructive. All Macie findings and bucket-inventory rows for that region are deleted from Prism. This cannot be undone.

note

Prism only commits region changes that actually settled. A region is added to the linked set only once the admin session in that region is confirmed up; a region is dropped only once its teardown fully succeeds. If a region's teardown fails, that region stays linked so that billable Macie sessions are never silently orphaned, and you can retry the change. If a region add fails, the region never joins the linked set and the reason is appended to the configuration's message.

Permissions Tab​

Prism needs a small, enumerated set of Amazon Macie permissions in each enrolled account, which it attaches as a policy named CKPrism-Macie-Permissions on that account's access role. This tab, headed Account permissions, reports whether that policy is in place and current in every enrolled account, and repairs it where it is not.

When you open the tab, a scan starts automatically and shows Checking account permissions… while it runs. Each account is then listed in a table of Account, Permissions, and Details, with the permissions state as one of three chips:

StateMeaning
CurrentThe expected policy is attached and up to date
Needs updateA policy is attached but does not match what Prism expects
MissingNo policy is attached

Below the table, Fix roles re-applies the policy to the accounts that need it, then re-runs the scan so you can confirm the result. It is disabled when nothing needs attention. Re-check re-runs the scan on its own. A summary line beside the buttons reads either "All accounts are up to date." or a count such as "3 accounts need attention."

If Macie has no enrolled accounts yet, the tab reads "No enrolled accounts to check yet — enroll an account to start tracking its role permissions."

Use this tab when:

  • An account failed enrollment with a permissions or AccessDenied error, fix the roles, then Retry the account from Enrollment
  • The policy was removed or edited directly in AWS
  • A Prism update changed the set of permissions Macie requires
info

This is a standing grant, not a temporary escalation. The policy stays attached to each enrolled account's access role for as long as that account is enrolled. It is detached when the account is removed cleanly, and from every account when Macie is cleanly disabled.

Danger Zone Tab​

The Danger zone tab, headed Disable Macie, lets you disable Macie for your entire organization.

warning

Disabling tears down all member enrollments and Macie sessions in every region. Cached findings and the bucket inventory are removed on a clean disable, and new findings and bucket inventory will not be collected until Macie is re-enabled.

To disable Macie:

  1. Click Disable Macie.
  2. The Confirm disable dialog opens: "Type the customer ID <your-customer-id> to confirm:". Type it into the Customer ID field exactly as shown, the Disable button stays disabled until the text matches.
  3. Click Disable to confirm, or Cancel to abandon.

After confirmation, the page navigates to the Dashboard entry. It detects the in_progress teardown and shows a progress screen headed "Disabling Macie…", with the body "Tearing down members and Macie sessions across every linked region. This can take a few minutes." The progress bar is indeterminate for this operation.

Teardown runs in a fixed order: per region, the admin disassociates and deletes every member (including any orphans it discovers with ListMembers); then each member disables its own Macie session; then the admin disables its own session last, because it is still transitioning out of the administrator role and a plain disable there can silently no-op. Prism verifies each session is genuinely gone rather than trusting an HTTP 200, and treats already-gone resources as success.

Partial Failure on Disable​

If every teardown step succeeds, the status transitions to disabled, the CKPrism-Macie-Permissions policy is detached from every account's access role, the cached findings and bucket-inventory rows are cleared from Prism, and the setup wizard is shown.

If any teardown step genuinely fails, the configuration does not move to disabled; it stays in partial_failure so the affected region or member stays visible for retry (this prevents billable Macie sessions from being silently left running). In that case the permission policies are not detached — a retry needs them — and cached findings and bucket rows are retained. Re-open Settings and disable again to retry the remaining teardown, or fix the underlying account and retry; a repeated teardown treats already-removed resources as success, so retrying is safe.

info

You can re-enable Macie at any time by running the setup wizard again. Finding and bucket history retained in Prism is not updated until the first refresh after re-enabling.