Skip to main content

Macie Should Be Enabled In Account Per Region.

More Info:​

This rule checks if Amazon Macie is enabled in your account per region. The rule is NON_COMPLIANT if the status attribute is not set to ENABLED.

Risk Level​

High

Address​

Configuration

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of Macie not being enabled in the AWS account per region, you can follow these steps using the AWS Management Console:

  1. Sign in to the AWS Management Console:

  2. Navigate to Macie Service:

    • In the AWS Management Console, search for "Macie" in the services search bar and select the Amazon Macie service.

  3. Enable Macie in the Account:

    • In the Macie dashboard, click on the "Get Started" button to enable Macie in your account.
    • Follow the on-screen instructions to set up Macie for your account. This may include configuring the Macie settings, such as choosing the regions where you want Macie to be enabled.

  4. Enable Macie in Each Region:

    • To enable Macie in each region, navigate to the Macie service in each region by selecting the region from the top right corner of the AWS Management Console.
    • Follow the same steps as mentioned in step 3 to enable Macie in each region where you want it to be enabled.

  5. Verify Macie Configuration:

    • Once Macie is enabled in the account and in each region, verify that the service is configured correctly by checking the Macie dashboard and settings in each region.

  6. Monitor Macie Alerts:

    • Set up alerts and notifications in Macie to monitor and receive alerts for any security findings or sensitive data discovery in your account.

By following these steps, you can remediate the misconfiguration of Macie not being enabled in the AWS account per region and ensure that Macie is set up and configured correctly to help with data security and compliance in your AWS environment.

Using CLI

To remediate the misconfiguration of Macie not being enabled in an AWS account per region, you can follow these steps using AWS CLI:

Step 1: List the regions where Macie is not enabled in your AWS account

aws ec2 describe-regions --query "Regions[].RegionName" --output text | while read region; do aws macie2 describe-bucket-level-operations --region $region || echo "Macie not enabled in region $region"; done

Step 2: Enable Macie in each region where it is not enabled

aws macie2 create-member --account-id YOUR_ACCOUNT_ID --region REGION_NAME

Replace YOUR_ACCOUNT_ID with your AWS account ID and REGION_NAME with the specific region where Macie is not enabled.

Step 3: Verify that Macie is now enabled in all regions

aws ec2 describe-regions --query "Regions[].RegionName" --output text | while read region; do aws macie2 describe-bucket-level-operations --region $region || echo "Macie not enabled in region $region"; done

By following these steps using AWS CLI, you can remediate the misconfiguration of Macie not being enabled in an AWS account per region.

Using Python

To remediate the misconfiguration of Macie not being enabled in the AWS account per region using Python, you can follow these steps:

  1. Import the necessary Python libraries:
import boto3
  1. Initialize the AWS Config and Macie clients:
config_client = boto3.client('config')
macie_client = boto3.client('macie2')
  1. Retrieve the list of AWS regions:
regions = [region['RegionName'] for region in boto3.client('ec2').describe_regions()['Regions']]
  1. Enable Macie in each region if it is not already enabled:
for region in regions:
    try:
        response = macie_client.describe_bucket(region=region)
    except macie_client.exceptions.ClientError as e:
        if e.response['Error']['Code'] == 'AccessDeniedException':
            print(f"Macie is not enabled in region {region}. Enabling Macie in this region...")
            try:
                macie_client.create_member(accountId='current', email='youremail@example.com')
                print(f"Macie has been enabled in region {region}.")
            except macie_client.exceptions.ClientError as e:
                print(f"Failed to enable Macie in region {region}. Error: {str(e)}")
        else:
            print(f"Failed to describe Macie in region {region}. Error: {str(e)}")
  1. Run the Python script to enable Macie in all regions of the AWS account. Make sure you have the necessary permissions to enable Macie in the account.

Please note that the above script assumes you have the necessary permissions to enable Macie in the AWS account. You may need to adjust the script based on your specific requirements and environment.

Using Terraform
# Enables Amazon Macie in the target AWS account for this region
provider "aws" {
  region = "AWS_REGION_CODE" # e.g., "us-east-1"
}

resource "aws_macie2_account" "macie" {
  status = "ENABLED"

  # Optional: adjust as needed; does not affect the compliance check itself
  # Allowed values: "FIFTEEN_MINUTES", "ONE_HOUR", "SIX_HOURS"
  finding_publishing_frequency = "FIFTEEN_MINUTES"
}

Enabling Macie in a region creates/updates the Macie account configuration for that region and may incur costs; if Macie is centrally managed via AWS Organizations with a delegated Macie administrator, this resource must be applied from the delegated administrator account for member accounts.

This change does not replace existing application resources, but it does enable a new managed service in the account/region.

To verify, terraform plan should show creation (or update) of aws_macie2_account.macie with status: "ENABLED" for the configured provider region.

Additional Reading:​