Amazon Macie is not enabled

Severity: Medium
Service: Data protection
Check ID: MACIE_NOT_ENABLED

What this check finds

Amazon Macie is not active in this region. Macie uses machine learning to automatically discover, classify, and protect sensitive data (PII, credentials, financial data) stored in S3. Without it, S3 data exposure goes undetected.

Passing looks like: Amazon Macie enabled.

How to fix it

Enable Macie.

AWS CLI

```
aws macie2 enable-macie
```

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

Macie → Get started → Enable Macie. Enable via AWS Organizations for all accounts centrally.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to Amazon Macie is not enabled
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	2.1.3 Ensure all data in Amazon S3 has been discovered, classified, and secured when necessary
NIST SP 800-53 Rev5 (Moderate)	AC-4 Information Flow Enforcement SI-4 System Monitoring
NIST Cybersecurity Framework 2.0	PR.IR-01 Networks and environments are protected from unauthorized logical access and usage DE.CM-01 Networks are monitored
ISO/IEC 27001:2022 Annex A	A.8.12 Data leakage prevention A.8.16 Monitoring activities A.8.22 Segregation of networks

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs