Enabling Macie
The Macie setup wizard walks you through six steps to deploy Amazon Macie centrally across your organization. After you submit, an asynchronous job enables Macie in the administrator account, enrolls member accounts by invitation, and optionally turns on automated sensitive-data discovery.
Accessing the Wizard
- If no Security Hub engines are enabled yet, opening the Security Hub drops you straight into the Enable Security Hub panel. Click Enable on the Data security card (the one labelled
maciebeneath its title). - If another engine (CSPM, GuardDuty, Inspector, or Detective) is already live, go to Configuration > Capabilities, which shows the same Security capabilities panel, and click Enable on the Data security card. The Security Hub Overview also shows an Amazon Macie card with an Enable button, and the sidebar shows an Enable Amazon Macie row. All of them open the same wizard.
The wizard is headed Set up Macie, "Enable Amazon Macie S3 data-security posture across your organization".
Wizard Steps
| Step | Name | What you configure |
|---|---|---|
| 1 | Admin account | The AWS account that acts as the Macie administrator |
| 2 | Regions | The home region and the additional linking regions |
| 3 | Members | The member accounts to enroll |
| 4 | Emails | The root email address for each member account |
| 5 | Discovery | Whether to enable automated sensitive-data discovery (off by default) |
| 6 | Review | Confirm all settings before submitting |
Each step has a Back button (disabled on step 1) and a Next button. On the final step, Next is replaced by Enable Macie.
Prerequisites
- At least one AWS account is available in Prism to serve as the Macie administrator
- You know the real AWS root email address for each member account you plan to enroll (see the Emails step below)
Step 1: Admin Account
Select the AWS account that will act as the Macie administrator. This account aggregates the S3 bucket inventory and findings from all enrolled member accounts.
| Field | Required | Notes |
|---|---|---|
| Admin account | Yes | Search by name or account ID; the selected account is removed from the member list on step 3 |
Next stays disabled until an admin account is selected.
The admin account is permanent for this deployment. To change it you must disable Macie entirely and run the setup wizard again, losing all accumulated findings and bucket inventory in Prism.
Step 2: Regions
Select the home region and any additional linking regions where Macie is enabled.
| Field | Required | Default | Notes |
|---|---|---|---|
| Home region | Yes | us-east-1 | The primary region; changing it automatically adds it to the linking regions list, and it cannot be removed after setup |
| Linking regions | Yes | us-east-1 | Multi-select; the home region is locked into the selection and cannot be deselected |
Macie enables a session per linked region and aggregates the bucket inventory and findings from every enrolled account in each. Next stays disabled until a home region is chosen and at least one linking region including the home region is selected. You can add or remove linking regions later from Settings.
Step 3: Members
Select the member accounts to enroll. The wizard states "Pick the member accounts to enroll. The admin is always included." — the admin account is filtered out of the selection list because it is enrolled regardless.
| Field | Required | Notes |
|---|---|---|
| Member accounts | No | Search by name or account ID; multi-select |
You can add or remove member accounts after setup from the Enrollment page without rerunning the wizard.
Step 4: Emails
Macie uses invitation-based member association, which requires the real AWS root email address of each member account. Prism resolves root emails automatically where possible; the lookup runs as soon as you enter this step and re-runs if you go back and change the member selection.
- Auto-resolved accounts show the email address followed by an (auto) label in green. There is no input field for these — the value is display-only.
- Unresolved accounts show an editable Root email field. Its helper text carries the reason auto-fetch failed, or the fallback "Auto-fetch failed — enter this account's AWS root email". The field is flagged in error until you type something.
If you selected no member accounts on step 3, the step shows "No member accounts selected. Go back and pick at least one." and you can continue straight to Discovery.
Next stays disabled while the lookup is running and until every unresolved account has an email typed in.
To find a member account's root email address, sign in to that AWS account and go to Account Settings > Account > Email address in the AWS Console.
Entering an incorrect or placeholder email address can cause an email-verification error and Macie cannot invite that member. Use the real root account email address, not an alias, distribution list, or IAM user email.
Prism resolves root emails in parallel (up to ten accounts at a time), so a large selection is not resolved one account after another. An account that cannot be resolved is not a blocker: it simply gets a Root email field with the reason, and you type the address in. Only the addresses you type are sent on submit, auto-resolved accounts are re-resolved server-side.
Step 5: Discovery
Choose whether to enable automated sensitive-data discovery.
| Field | Default | Notes |
|---|---|---|
| Enable automated sensitive-data discovery (charged per GB inspected) | Off | When enabled, Macie continually samples objects across your enrolled S3 buckets to compute per-bucket sensitivity scores and produce sensitive-data findings |
Automated sensitive-data discovery is billed by AWS per GB of S3 data inspected across your entire organization. Leaving it off still gives you the full S3 bucket posture inventory and policy findings. Turn discovery on only when you understand the per-GB billing implications; across many large buckets it can incur significant cost. You can toggle it later from Settings.
Step 6: Review
The Review step summarizes your selections before you submit:
| Row | Value |
|---|---|
| Admin account | The selected account ID |
| Home region | The selected home region |
| Linking regions | Comma-separated list |
| Member accounts | A count in the form "N (including admin)" |
| Automated discovery | "On (per-GB charges apply)" or "Off" |
Click Enable Macie to submit; the button reads Enabling… while the request is in flight. If the submit fails for any reason, including an email-validation error, the wizard returns you to the Emails step and shows the error there. Correct the failing email addresses and resubmit.
What Happens After Submission
After you click Enable Macie, the wizard hands off to an asynchronous job. The step content is replaced by a status view that polls the job and shows a progress bar. The heading reflects the job status:
| Status | Heading |
|---|---|
in_progress | Setting up Macie… |
enabled | Macie is enabled |
partial_failure | Macie enabled with partial failures |
failed | Setup failed |
disabled | Macie is disabled |
While the job runs, the view explains: "Enrolling member accounts, enabling Macie sessions, and inviting members from the administrator account. This can take a few minutes." Below the progress bar it repeats the Admin account and Home region you chose.
The job:
- Attaches the persistent
CKPrism-Macie-Permissionspolicy to the admin account's access role and waits for it to be usable. A failure here fails the whole configuration, because nothing downstream can succeed without it. - Enables a Macie session in the admin account for each linked region. A failure in any region fails the whole configuration.
- Attaches the same permission policy to each member account. An account whose grant fails is marked failed and dropped from enrollment, it does not block the others.
- Enables Macie in each member account, per region, in parallel.
- Invites each member account from the admin using its root email address (
CreateMember, thenCreateInvitations), one account at a time per region. Email notification is suppressed, so members are not emailed by AWS. An account that is already an associated member is marked enabled directly. - Accepts the invitation on behalf of each invited member account.
- If you enabled it in the Discovery step, turns on automated sensitive-data discovery for the admin plus every successfully-enrolled member.
If any member accounts fail, the overall status becomes partial_failure. The Dashboard shows a warning banner reading "Macie setup partially failed." with a Review button that opens Enrollment, where you can retry the failed accounts.
A prior failed or disabled Macie configuration is cleared automatically when you resubmit the wizard. You do not need to manually delete the old state before running setup again. If a previous attempt failed, the wizard shows a warning across the top, "The previous setup attempt failed: …. Submitting again will clear that state and retry."
If automated discovery could not be turned on but every account enrolled successfully, the enablement still completes; the discovery problem is appended as a note to the configuration's message rather than failing the whole enablement. You can retry it from Settings by saving the discovery setting again.
Related Pages
- Dashboard, What you see after setup completes
- Enrollment, Add more members or retry failed accounts
- Settings, Change regions or automated discovery after setup
- Security Hub Issues, Troubleshooting setup failures and email resolution problems