Most organisations cannot say which of their Amazon S3 buckets hold personal data, card numbers or live credentials, and Amazon Macie exists to answer that question at scale. Macie is AWS's managed service for discovering sensitive data in S3 general purpose buckets and for flagging bucket access control changes. Because it can read every object in every member account and can reveal samples of the sensitive data it finds, Macie is also a privileged service that needs securing in its own right. This guide covers how Macie's identities, roles and multi-account model work, how to run automated discovery and jobs, how findings flow into detection, and the misconfigurations that leave gaps or overexpose data. It is written for cloud security engineers and data protection teams. The vendor-neutral programme around tools like this is in the DSPM Implementation Playbook.
This is an independent guide from NHI Mgmt Group, based on AWS's public documentation as of November 2026. It is not sponsored or reviewed by AWS. Product features change, so confirm settings against AWS's current documentation.
Key takeaways
- Two discovery modes, two purposes. Automated sensitive data discovery samples objects daily across all buckets to build a map; sensitive data discovery jobs analyse defined buckets in depth, once or on a schedule.
- Macie reads through a service-linked role (AWSServiceRoleForAmazonMacie), and an explicit Deny in a bucket policy silently stops it unless you exempt that role with aws:PrincipalArn.
- Revealing samples is the sensitive permission. Whoever can retrieve samples sees the first 1 to 10 occurrences of real data from a finding, so restrict it to a dedicated role and a dedicated KMS key.
- Keep the evidence. Macie retains sensitive data discovery results for only 90 days unless you configure a repository bucket encrypted with a customer managed KMS key.
- Credentials findings are incidents. SensitiveData:S3Object/Credentials means secret access keys or private keys sit in an object; route them to rotation, not to a data protection queue.
How identity and access work in Amazon Macie
Macie is a regional service enabled per account and per Region. Once enabled it builds an S3 bucket inventory, evaluates each bucket's public access, encryption and sharing settings, and analyses objects for sensitive data using managed data identifiers (AWS-maintained detectors for PII, financial data and credentials across many countries), custom data identifiers (regular expressions with optional keywords and proximity rules) and allow lists (text or patterns to ignore, such as test data or public contact details).
Automated discovery versus jobs
| Aspect | Automated sensitive data discovery | Sensitive data discovery jobs |
|---|---|---|
| Scope | All general purpose buckets by default, including member accounts for an organisation administrator; exclusions allowed | Buckets and criteria you select |
| Depth | Sampling of representative objects, progressing daily | You set sampling depth and object criteria |
| Schedule | Continuous | One time or recurring |
| Who can configure | Organisation Macie administrator or standalone account | Administrator for any member bucket; members for their own buckets |
| Who sees findings | Only the administrator | Only the account that created the job |
| Best for | Estate-wide visibility and bucket sensitivity, prioritising where to look | Compliance evidence, full scans of high-risk buckets, scans after an incident |
Decision guidance: start with automated discovery to find which buckets matter, excluding buckets that hold AWS logs, then run targeted jobs on the buckets it ranks as sensitive and on any bucket in scope for PCI DSS or GDPR evidence. Small single-account estates can often rely on scheduled jobs alone; large organisations need automated discovery because nobody can maintain a job list for thousands of buckets.
Finding types
| Finding type | Meaning | Typical response |
|---|---|---|
| Policy:IAMUser/S3BlockPublicAccessDisabled | All bucket-level Block Public Access settings disabled | Re-enable unless the bucket is an approved public site |
| Policy:IAMUser/S3BucketPublic | ACL or bucket policy now allows anonymous users or all authenticated AWS identities | Treat as urgent if the bucket is sensitive |
| Policy:IAMUser/S3BucketSharedExternally | Shared with an AWS account outside your organisation | Confirm a contract and data sharing basis exist |
| Policy:IAMUser/S3BucketReplicatedExternally | Replication to a bucket in an account outside your organisation | Check for exfiltration (ATT&CK T1537) |
| Policy:IAMUser/S3BucketEncryptionDisabled | Default encryption reset to default S3 behaviour | Restore SSE-KMS where policy requires it |
| Policy:IAMUser/S3BucketSharedWithCloudFront | Bucket policy shares with a CloudFront OAI or OAC | Confirm the distribution is intended |
| SensitiveData:S3Object/Credentials | Credentials such as AWS secret access keys or private keys | Rotate the credential, then remove the object |
| SensitiveData:S3Object/Personal, /Financial, /CustomIdentifier, /Multiple | PII or PHI, financial data, custom matches, or several categories | Classify, restrict access, apply retention |
Bucket configuration hardening itself belongs to the Amazon S3 Security Guide; Macie tells you where that hardening matters most.
Admin roles and privileged access
Macie has three layers of privilege: the people who configure it, the service-linked role that reads your data, and the identities that reveal samples.
| Identity | What it can do | Control |
|---|---|---|
| AmazonMacieFullAccess (AWS managed policy) | All Macie read and write actions, create the service-linked role, read pricing; required to enable Macie | Grant only to the platform team, ideally through IAM Identity Center permission sets |
| AmazonMacieReadOnlyAccess | Read-only access to Macie resources, data and settings | Suitable for analysts; note it still exposes findings metadata |
| AWSServiceRoleForAmazonMacie with AmazonMacieServiceRolePolicy | Read S3 bucket and object information and retrieve objects, read Organizations account data, write job logs to CloudWatch Logs | Cannot be attached elsewhere; monitor its S3 data access |
| Reveal role (trusted by reveal-samples.macie.amazonaws.com) | s3:GetObject to extract samples, plus kms:Decrypt for objects under customer managed keys | Dedicated role name, aws:SourceAccount condition, used only when a user chooses to reveal |
| Macie administrator account | Enable or suspend Macie for members, run jobs on member buckets, see all policy findings and all automated discovery findings | Use a dedicated security tooling account as delegated administrator |
- Prefer AWS Organizations over invitations. AWS recommends the Organizations integration. An organisation member cannot suspend Macie, and cannot disable it until the administrator disassociates the account; an invitation member can suspend it, which lets a compromised member account blind you. See the AWS Organizations and SCPs Guide.
- Write customer managed policies. AWS itself recommends narrower customer managed policies than the managed ones. Separate "configure Macie" from "read findings" from "reveal samples".
- Protect Macie with SCPs: deny macie2:DisableMacie, macie2:UpdateMacieSession and macie2:DisassociateFromAdministratorAccount to everyone except the security platform role, so an attacker in a workload account cannot switch it off.
Integrations, API tokens and service accounts
Macie's non-human identities are the service-linked role, the reveal role, the KMS keys and whatever automation consumes findings.
Sample retrieval
Macie can reveal samples using either the requesting user's own IAM identity or an IAM role it assumes. With the role option, Macie assumes the role only when a user chooses to reveal samples, the sensitive data discovery result must be signed with an HMAC KMS key, and in an organisation the role name must be identical in the administrator account and every member account. Member roles trust the administrator's role with an external ID that Macie generates, plus an aws:PrincipalOrgID condition for Organizations members. Macie extracts the first 1 to 10 occurrences, up to 128 characters each, for up to 100 data types, encrypts them with a KMS key you choose, and deletes them from its cache soon after. Sample retrieval is not available in Asia Pacific (Osaka) or Israel (Tel Aviv).
- Use a dedicated KMS key for samples, as AWS recommends, and give kms:Decrypt on it only to the few people who triage findings.
- Prefer the role option at scale: it avoids giving every analyst s3:GetObject across all buckets.
Discovery results repository
Configure it under Settings, Discovery results, or with PutClassificationExportConfiguration. It needs an S3 general purpose bucket and a customer managed symmetric KMS key in the same Region. Macie writes one JSON Lines record per analysed object, including objects it could not analyse, with locations of up to 1,000 occurrences per data type but never the data itself, and since 8 November 2023 signs the files with an HMAC KMS key. Keep the aws:SourceAccount and aws:SourceArn conditions in the key and bucket policies, which AWS says prevent the confused deputy problem, and add Deny statements for uploads without SSE-KMS or without aws:SecureTransport.
Findings consumers
Macie always publishes findings to Amazon EventBridge, and can publish to AWS Security Hub CSPM, which by default receives only new and updated policy findings. Turn on sensitive data findings for Security Hub if your SOC works from there. Lambda functions or SOAR playbooks that react to findings are themselves privileged: a function that can change bucket policies or quarantine objects needs least privilege and its own logging. See the AWS Security Hub Guide.
Where identity fits
Macie is one of the few AWS tools that finds non-human credentials at rest: SensitiveData:S3Object/Credentials covers AWS secret access keys and private keys left in exports, backups and build artefacts (ATT&CK T1552.001 Credentials In Files). Treat each credentials finding as a leaked secret, with the steps in the AWS Access Keys Security Guide.
Logging and detection
- CloudTrail management events under the event source macie2.amazonaws.com record Macie configuration calls. Alert on DisableMacie, UpdateMacieSession (which changes status or publishing frequency), disassociation of members, deletion of the export configuration and new suppression rules (CreateFindingsFilter with an archive action). Suppressed findings are not published to EventBridge or Security Hub, so a malicious suppression rule hides findings. See the AWS CloudTrail Guide.
- Sample reveals: AWS states that sample retrieval actions are logged in CloudTrail; alert on reveals outside an open ticket and on reveals by unexpected principals.
- Job logs: the service-linked role writes job events to CloudWatch Logs; watch for objects Macie could not analyse because of permissions, which usually signals a bucket policy Deny.
- Finding routing: EventBridge rules for SensitiveData:S3Object/Credentials and Policy:IAMUser/S3BucketPublic go straight to on-call; policy finding updates publish every 15 minutes by default, adjustable per Region.
Metrics:
- Percentage of S3 buckets and accounts covered by automated discovery (target: all except documented exclusions).
- Number of buckets Macie could not analyse, and the trend.
- Mean time to rotate a credential after a Credentials finding.
- Count of open public or externally shared findings on sensitive buckets.
- Number of sample reveals per month and the share tied to tickets.
Hardening baseline
- Designate the administrator: in the Organizations management account, delegate Macie administration to a security tooling account, and enable Macie for all members in every Region you use.
- Configure the repository first: bucket, customer managed KMS key, policies with confused deputy conditions, so the 90 days of results are kept from day one.
- Pilot automated discovery in a subset of accounts, exclude log buckets, review cost estimates, then expand. The 30-day free trial covers bucket evaluation and, depending on settings, automated discovery, but not jobs.
- Tune: add custom data identifiers for internal identifiers and allow lists for known test data; avoid broad allow lists that hide real data.
- Fix blind spots: add the aws:PrincipalArn exemption for AWSServiceRoleForAmazonMacie to restrictive Deny statements (for example VPC endpoint-only policies).
- Wire response: EventBridge rules, Security Hub publishing for sensitive data findings, and runbooks per finding type.
- Configure reveal with a dedicated role, identical name across accounts, and a dedicated KMS key.
- Roll back: narrowing scope (excluding buckets or disabling automated discovery per account) reduces cost without losing results already saved; suspending rather than disabling Macie keeps configuration, while disabling deletes Macie data for the account.
Common misconfigurations
- No discovery results repository: after 90 days the evidence of what Macie analysed is gone, which matters in a breach investigation or audit.
- Restrictive bucket policies without the Macie exemption: the most sensitive buckets, often locked to a VPC endpoint, are exactly the ones Macie cannot read.
- Invitation-based membership: members can suspend Macie themselves.
- Everyone can reveal samples: broad s3:GetObject plus the sample KMS key turns a detection tool into a data access path.
- Credentials findings treated as data hygiene: deleting the object without rotating the key leaves a live credential that may already be copied.
- Single-Region enablement: Macie is regional; buckets in Regions where it is not enabled are invisible.
Framework mapping
| Framework | Reference | How Macie supports it |
|---|---|---|
| NIST CSF 2.0 | ID.AM-07, PR.DS-01, DE.CM-09 | Data inventory, protecting data at rest, monitoring data stores |
| NIST SP 800-53 Rev 5 | CM-12, CM-12(1), SI-4, AC-6 | Information location with automated tools, monitoring, least privilege for reveal and admin roles |
| ISO/IEC 27001:2022 Annex A | 5.12 Classification of information, 8.12 Data leakage prevention | Finding and classifying data, detecting exposure |
| CIS Controls v8.1 | Control 3 Data Protection | Data inventory and access control on sensitive data |
| MITRE ATT&CK | T1530, T1552.001, T1537 | Data from Cloud Storage, Credentials In Files, Transfer Data to Cloud Account |
Practitioner checklist
- Delegate Macie administration to a security account through AWS Organizations and enable it in every Region in use.
- Configure the discovery results repository with a customer managed KMS key before running discovery.
- Enable automated discovery with log buckets excluded, then schedule jobs for high-risk buckets.
- Exempt AWSServiceRoleForAmazonMacie from restrictive bucket policy Deny statements.
- Restrict sample reveal to a dedicated role and KMS key, and alert on reveals.
- Protect Macie with SCPs against disablement and member disassociation.
- Publish sensitive data findings to Security Hub and route Credentials findings to secret rotation.
- Review suppression rules and allow lists quarterly.
- Track coverage, unanalysable buckets and credential rotation time as KPIs.
Standards and references
- AWS: What is Amazon Macie?
- AWS: Types of Amazon Macie findings
- AWS: Macie administrator and member account relationships
- AWS: Storing and retaining sensitive data discovery results
- AWS: Configuring Macie to retrieve sensitive data samples
- AWS: Allowing Macie to access S3 buckets with restrictive policies
- AWS: AWS managed policies for Amazon Macie
- AWS: Configuring publication settings for Macie findings
Related NHI Mgmt Group resources: DSPM Implementation Playbook · Amazon S3 Security Guide · Data Classification Guide · AWS Security Guide