AWS Data Protection Hardening

Enable Amazon S3 Block Public Access at the account level in every AWS account, with all four sub-settings (BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets) set to true, and pin the setting with an organization-wide SCP that denies any principal in any member account from removing it. Account-level BPA is a region-independent invariant managed through the s3control API — distinct from per-bucket BPA which is managed through s3api — and overrides any bucket-level grant that would otherwise expose objects (AWS S3 User Guide — Block Public Access (accessed 2026-05)). It is the single highest-leverage S3 misconfiguration mitigation AWS exposes; CIS AWS Foundations v3.0.0 codifies it as control 2.1.4. The control deliberately uses the SCP pin (not just the account toggle) because every Capital-One-class incident in recent history followed the same template: a single bucket misconfigured by a single engineer in a single account where the platform team had not foreseen this account's emergence.

Remediation — AWS CLI

# Account-level BPA — note the service is s3control (NOT s3api) and the account-id is required.
aws s3control put-public-access-block \
  --account-id 111122223333 \
  --public-access-block-configuration \
    BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

# Verify (note the same service distinction).
aws s3control get-public-access-block --account-id 111122223333

# Bucket-level BPA is a DIFFERENT command (kept for awareness; account-level is the canonical control).
# aws s3api put-public-access-block --bucket my-bucket --public-access-block-configuration ...

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
# Account-level BPA — once-per-account invariant.
resource "aws_s3_account_public_access_block" "this" {
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# Org-wide SCP pinning: deny removal of the account-level invariant from any member account.
resource "aws_organizations_policy" "deny_disable_s3_account_bpa" {
  name = "deny-disable-s3-account-bpa"
  type = "SERVICE_CONTROL_POLICY"
  content = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Sid    = "DenyDisableAccountBpa"
      Effect = "Deny"
      Action = [
        "s3:PutAccountPublicAccessBlock",
        "s3:DeleteAccountPublicAccessBlock"
      ]
      Resource = "*"
      Condition = {
        StringNotEquals = {
          "aws:PrincipalArn" = "arn:aws:iam::${var.platform_account_id}:role/PlatformDataAdmin"
        }
      }
    }]
  })
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: Account-level S3 Block Public Access — denies any bucket from ever becoming public.
Resources:
  AccountBpa:
    Type: AWS::S3::AccountPublicAccessBlock
    Properties:
      AccountId: !Ref AWS::AccountId
      BlockPublicAcls: true
      BlockPublicPolicy: true
      IgnorePublicAcls: true
      RestrictPublicBuckets: true

Remediation — AWS CDK (TypeScript)

import * as cdk from 'aws-cdk-lib';
import { aws_s3 as s3 } from 'aws-cdk-lib';
import { Construct } from 'constructs';

export class AccountS3BpaStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    new s3.CfnAccountPublicAccessBlock(this, 'AccountBpa', {
      accountId: this.account,
      blockPublicAcls: true,
      blockPublicPolicy: true,
      ignorePublicAcls: true,
      restrictPublicBuckets: true,
    });
  }
}

Compliance mapping

fields @timestamp, eventName, requestParameters.publicAccessBlockConfiguration, requestParameters.bucketName, requestParameters.policy, userIdentity.arn
          | filter eventSource = "s3.amazonaws.com" and eventName in ["PutAccountPublicAccessBlock","DeletePublicAccessBlock","PutPublicAccessBlock","PutBucketPolicy"]
          | filter @message like /"BlockPublicAcls":false/ or @message like /"RestrictPublicBuckets":false/ or @message like /"Principal":"\*"/
          | sort @timestamp desc
          | limit 100

Equivalent on: Azure · GCP · OCI

Set the default encryption on every S3 bucket to aws:kms with a customer-managed CMK — not the AWS-managed aws/s3 key. Since January 2023, AWS encrypts every new S3 object with at least SSE-S3 by default, so the question is no longer "is encryption on" but "whose key is it". The AWS-managed aws/s3 key has a key policy AWS controls; rotating it, revoking it, or applying granular grants to it is impossible from the customer side. A customer-managed CMK (referenced by ARN in the bucket's encryption configuration) puts the customer in control of the key policy, the rotation schedule (covered in aws-data-06), the deletion window, and the audit trail (each Decrypt/GenerateDataKey call is logged in CloudTrail) (AWS S3 User Guide — default bucket encryption (accessed 2026-05)). CIS AWS Foundations v3.0.0 codifies SSE on every bucket as 2.1.1; the CMK requirement is the hardened reading of that control.

Remediation — AWS CLI

# Set default encryption on a bucket to SSE-KMS with a customer-managed CMK.
aws s3api put-bucket-encryption \
  --bucket my-regulated-bucket \
  --server-side-encryption-configuration '{
    "Rules": [{
      "ApplyServerSideEncryptionByDefault": {
        "SSEAlgorithm": "aws:kms",
        "KMSMasterKeyID": "arn:aws:kms:eu-west-1:111122223333:key/abcd1234-..."
      },
      "BucketKeyEnabled": true
    }]
  }'

# Audit: every bucket missing aws:kms with a CMK ARN.
aws s3api list-buckets --query 'Buckets[].Name' --output text | tr '\t' '\n' | while read b; do
  aws s3api get-bucket-encryption --bucket "$b" 2>/dev/null \
    | grep -q '"SSEAlgorithm": "aws:kms"' || echo "MISSING-CMK $b"
done

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
resource "aws_kms_key" "data_bucket" {
  description             = "CMK for regulated S3 buckets"
  deletion_window_in_days = 30
  enable_key_rotation     = true
}

resource "aws_kms_alias" "data_bucket" {
  name          = "alias/data-bucket-cmk"
  target_key_id = aws_kms_key.data_bucket.key_id
}

resource "aws_s3_bucket" "regulated" {
  bucket = "my-regulated-bucket"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "regulated" {
  bucket = aws_s3_bucket.regulated.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.data_bucket.arn
    }
    bucket_key_enabled = true
  }
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: S3 bucket using SSE-KMS with a customer-managed CMK and bucket key enabled.
Parameters:
  BucketName:
    Type: String
  KmsKeyArn:
    Type: String
Resources:
  EncryptedBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref BucketName
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - BucketKeyEnabled: true
            ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
              KMSMasterKeyID: !Ref KmsKeyArn
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

Compliance mapping

fields @timestamp, eventName, requestParameters.bucketName, requestParameters.serverSideEncryptionConfiguration, userIdentity.arn
          | filter eventSource = "s3.amazonaws.com" and eventName in ["PutBucketEncryption","DeleteBucketEncryption"]
          | filter eventName = "DeleteBucketEncryption" or @message like /"SSEAlgorithm":"AES256"/ or @message like /"SSEAlgorithm":null/
          | sort @timestamp desc
          | limit 100

Equivalent on: Azure · GCP · OCI

Enable EBS encryption-by-default in every region of every AWS account, and reference a customer-managed CMK as the default EBS key (not the AWS-managed aws/ebs key) so that the key policy, rotation schedule, and audit trail sit with the customer. Once on, every new EBS volume — root and data — is created encrypted with the configured CMK with no additional caller action; every new EBS snapshot is encrypted; every AMI built from an encrypted volume inherits encryption (Amazon EC2 — EBS encryption (accessed 2026-05)). The setting is per-region (not per-account global) — a single API call disables the invariant for that region, so the enable loop must iterate every active region and the configuration must be re-checked when AWS launches a new region. CIS AWS Foundations v3.0.0 codifies the default-encryption requirement as 2.2.1.

Remediation — AWS CLI

# Enable encryption-by-default per region.
for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  aws ec2 enable-ebs-encryption-by-default --region "$region"

  # Point the per-region default to a customer-managed CMK (not aws/ebs).
  aws ec2 modify-ebs-default-kms-key-id \
    --region "$region" \
    --kms-key-id alias/ebs-default-cmk
done

# Verify per region.
aws ec2 get-ebs-encryption-by-default --region eu-west-1
aws ec2 get-ebs-default-kms-key-id    --region eu-west-1

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
resource "aws_kms_key" "ebs_default" {
  description             = "EBS default encryption CMK (per region)"
  deletion_window_in_days = 30
  enable_key_rotation     = true
}

resource "aws_kms_alias" "ebs_default" {
  name          = "alias/ebs-default-cmk"
  target_key_id = aws_kms_key.ebs_default.key_id
}

resource "aws_ebs_encryption_by_default" "this" {
  enabled = true
}

resource "aws_ebs_default_kms_key" "this" {
  key_arn = aws_kms_key.ebs_default.arn
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: AWS Config managed rule asserting EBS encryption-by-default is enabled in the region.
Resources:
  EbsEncryptionByDefaultRule:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: ec2-ebs-encryption-by-default
      Source:
        Owner: AWS
        SourceIdentifier: EC2_EBS_ENCRYPTION_BY_DEFAULT

Compliance mapping

fields @timestamp, eventName, awsRegion, requestParameters.kmsKeyId, responseElements.volume.encrypted, responseElements.volume.volumeId, userIdentity.arn
          | filter eventSource = "ec2.amazonaws.com" and eventName in ["DisableEbsEncryptionByDefault","ModifyEbsDefaultKmsKeyId","CreateVolume"]
          | filter eventName != "CreateVolume" or responseElements.volume.encrypted = false
          | sort @timestamp desc
          | limit 100

Equivalent on: Azure · GCP · OCI

Encrypt every Amazon RDS instance and Aurora cluster at rest with a customer-managed CMK; encrypt Performance Insights data with the same CMK family; enable deletion protection. RDS encryption at rest is set at instance creation and cannot be toggled on an existing unencrypted instance — the documented migration is snapshot → copy snapshot with encryption → restore from copy, which requires a maintenance window and capacity for two copies of the database during the migration (Amazon RDS — encryption at rest (accessed 2026-05)). This single property makes "encrypt RDS at creation" a foundational invariant: missing it at provisioning time creates technical debt that is materially expensive to repay. CIS AWS Foundations v3.0.0 codifies the requirement as 2.3.1.

Remediation — AWS CLI

# Audit: every RDS instance without storage encryption.
aws rds describe-db-instances \
  --query 'DBInstances[?StorageEncrypted==`false`].[DBInstanceIdentifier,Engine]' \
  --output table

# New instance: encryption-at-rest with CMK, performance-insights encryption, deletion protection.
aws rds create-db-instance \
  --db-instance-identifier prod-orders \
  --engine postgres --engine-version 16.3 \
  --db-instance-class db.r6i.large \
  --allocated-storage 100 \
  --storage-encrypted \
  --kms-key-id arn:aws:kms:eu-west-1:111122223333:key/abcd1234-... \
  --enable-performance-insights \
  --performance-insights-kms-key-id arn:aws:kms:eu-west-1:111122223333:key/abcd1234-... \
  --deletion-protection \
  --master-username postgres \
  --master-user-password "$(aws secretsmanager get-random-password --output text)"

# Existing unencrypted instance: documented snapshot → copy-with-encryption → restore path.
# (Requires a maintenance window; not in-place.)

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
resource "aws_kms_key" "rds" {
  description             = "RDS encryption-at-rest CMK"
  deletion_window_in_days = 30
  enable_key_rotation     = true
}

resource "aws_db_instance" "prod_orders" {
  identifier                            = "prod-orders"
  engine                                = "postgres"
  engine_version                        = "16.3"
  instance_class                        = "db.r6i.large"
  allocated_storage                     = 100
  storage_encrypted                     = true
  kms_key_id                            = aws_kms_key.rds.arn
  performance_insights_enabled          = true
  performance_insights_kms_key_id       = aws_kms_key.rds.arn
  performance_insights_retention_period = 731
  deletion_protection                   = true
  backup_retention_period               = 30
  username                              = "postgres"
  manage_master_user_password           = true
  master_user_secret_kms_key_id         = aws_kms_key.rds.arn
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: AWS Config managed rule asserting all RDS DB instances are encrypted at rest.
Resources:
  RdsStorageEncryptedRule:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: rds-storage-encrypted
      Source:
        Owner: AWS
        SourceIdentifier: RDS_STORAGE_ENCRYPTED
      Scope:
        ComplianceResourceTypes:
          - AWS::RDS::DBInstance

Compliance mapping

fields @timestamp, eventName, requestParameters.dBInstanceIdentifier, requestParameters.storageEncrypted, requestParameters.publiclyAccessible, requestParameters.kmsKeyId, userIdentity.arn
          | filter eventSource = "rds.amazonaws.com" and eventName in ["CreateDBInstance","CreateDBCluster","RestoreDBInstanceFromDBSnapshot","ModifyDBInstance"]
          | filter requestParameters.storageEncrypted = false or requestParameters.publiclyAccessible = true
          | sort @timestamp desc
          | limit 100

Equivalent on: Azure · GCP · OCI

Author each customer-managed KMS key policy to grant kms:Decrypt and kms:GenerateDataKey only to specific role ARNs that have a documented need, retain the root-account grant for break-glass administration (do not remove it — without it the key becomes unmanageable if the only admin role is lost), and set a deletion window of at least 30 days. The key policy is the single authority on who can use a CMK — IAM permissions are not sufficient on their own; both layers must agree (AWS KMS Developer Guide — key policies (accessed 2026-05)). The most common antipattern (audited against the Phase 5 IAM rubric of least privilege) is the open Principal: "*" with a kms:ViaService condition, which permits decrypt by any principal that can route a call via the named service. CRITICAL because a permissive key policy nullifies every other data-at-rest control on this page: encryption with a key that anyone can decrypt is theatre.

Remediation — AWS CLI

# Inspect existing key policy.
aws kms get-key-policy --key-id alias/data-bucket-cmk --policy-name default \
  | jq -r .Policy | jq .

# Replace with a least-privilege policy.
cat > /tmp/key-policy.json <<'JSON'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RootAccountBreakGlass",
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::111122223333:root"},
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "AppRoleEncryptDecrypt",
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::111122223333:role/app-prod"},
      "Action": ["kms:Decrypt", "kms:GenerateDataKey", "kms:DescribeKey"],
      "Resource": "*"
    }
  ]
}
JSON

aws kms put-key-policy \
  --key-id alias/data-bucket-cmk \
  --policy-name default \
  --policy file:///tmp/key-policy.json

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
data "aws_caller_identity" "current" {}

resource "aws_kms_key" "data_bucket" {
  description             = "CMK for regulated S3 buckets (least-privilege policy)"
  deletion_window_in_days = 30
  enable_key_rotation     = true

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "RootAccountBreakGlass"
        Effect    = "Allow"
        Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
        Action    = "kms:*"
        Resource  = "*"
      },
      {
        Sid    = "AppRoleEncryptDecrypt"
        Effect = "Allow"
        Principal = {
          AWS = [
            "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/app-prod"
          ]
        }
        Action = [
          "kms:Decrypt",
          "kms:GenerateDataKey",
          "kms:DescribeKey"
        ]
        Resource = "*"
      }
    ]
  })
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: KMS CMK with a least-privilege key policy — admin and usage principals separated, no Principal '*'.
Parameters:
  AdminRoleArn:
    Type: String
  UsageRoleArn:
    Type: String
Resources:
  AppCmk:
    Type: AWS::KMS::Key
    Properties:
      Description: Application-scoped CMK with admin/usage separation.
      EnableKeyRotation: true
      KeyPolicy:
        Version: '2012-10-17'
        Statement:
          - Sid: EnableAccountRoot
            Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'
            Action: kms:*
            Resource: '*'
          - Sid: AdminPlane
            Effect: Allow
            Principal:
              AWS: !Ref AdminRoleArn
            Action:
              - kms:Create*
              - kms:Describe*
              - kms:Enable*
              - kms:List*
              - kms:Put*
              - kms:Update*
              - kms:Revoke*
              - kms:Disable*
              - kms:Get*
              - kms:Delete*
              - kms:TagResource
              - kms:UntagResource
              - kms:ScheduleKeyDeletion
              - kms:CancelKeyDeletion
            Resource: '*'
          - Sid: UsagePlane
            Effect: Allow
            Principal:
              AWS: !Ref UsageRoleArn
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: '*'

Remediation — AWS CDK (TypeScript)

import * as cdk from 'aws-cdk-lib';
import { aws_kms as kms, aws_iam as iam } from 'aws-cdk-lib';
import { Construct } from 'constructs';

export interface AppCmkProps extends cdk.StackProps {
  adminRoleArn: string;
  usageRoleArn: string;
}

export class AppCmkStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: AppCmkProps) {
    super(scope, id, props);

    const adminRole = iam.Role.fromRoleArn(this, 'AdminRole', props.adminRoleArn);
    const usageRole = iam.Role.fromRoleArn(this, 'UsageRole', props.usageRoleArn);

    const key = new kms.Key(this, 'AppCmk', {
      description: 'Application-scoped CMK with admin/usage separation.',
      enableKeyRotation: true,
    });

    key.addToResourcePolicy(new iam.PolicyStatement({
      sid: 'AdminPlane',
      principals: [adminRole],
      actions: [
        'kms:Create*', 'kms:Describe*', 'kms:Enable*', 'kms:List*', 'kms:Put*',
        'kms:Update*', 'kms:Revoke*', 'kms:Disable*', 'kms:Get*', 'kms:Delete*',
        'kms:TagResource', 'kms:UntagResource',
        'kms:ScheduleKeyDeletion', 'kms:CancelKeyDeletion',
      ],
      resources: ['*'],
    }));

    key.addToResourcePolicy(new iam.PolicyStatement({
      sid: 'UsagePlane',
      principals: [usageRole],
      actions: [
        'kms:Encrypt', 'kms:Decrypt', 'kms:ReEncrypt*',
        'kms:GenerateDataKey*', 'kms:DescribeKey',
      ],
      resources: ['*'],
    }));
  }
}

Compliance mapping

fields @timestamp, eventName, requestParameters.keyId, requestParameters.policy, requestParameters.granteePrincipal, requestParameters.pendingWindowInDays, userIdentity.arn
          | filter eventSource = "kms.amazonaws.com" and eventName in ["PutKeyPolicy","CreateGrant","ScheduleKeyDeletion","UpdateAlias"]
          | filter @message like /"Principal":"\*"/ or eventName != "PutKeyPolicy"
          | sort @timestamp desc
          | limit 100

Equivalent on: Azure · GCP · OCI

Enable annual automatic rotation on every customer-managed symmetric CMK in the account, and assert the property via AWS Config managed rule cmk-backing-key-rotation-enabled. Automatic rotation re-keys the underlying backing-key material on a 365-day schedule (custom periods 90–2560 days available since 2023); the key ARN and key ID do not change, so consumers do not need to be re-pointed, but the cryptographic material protecting new ciphertext is fresh (AWS KMS Developer Guide — rotating keys (accessed 2026-05)). The typology is DETECTIVE, not PREVENTIVE — following the rubric in methodology, rotation does not prevent a key compromise (an attacker who has stolen the current backing key still has it); it bounds the usable window of a compromised key, and surfaces stale-key configurations through the Config rule. This is the same PITFALL B-14 distinction made for IAM access-key rotation (aws-iam-05) on the Phase 5 page. Severity MEDIUM because rotation alone is a weak mitigation against a determined attacker; it shines when paired with the key-policy hygiene of aws-data-05 and the audit trail of CloudTrail KMS events.

Remediation — AWS CLI

# Enable rotation on an existing CMK.
aws kms enable-key-rotation --key-id alias/data-bucket-cmk

# Verify.
aws kms get-key-rotation-status --key-id alias/data-bucket-cmk \
  --query 'KeyRotationEnabled' --output text

# Detective: AWS Config managed rule across the estate.
aws configservice put-config-rule --config-rule '{
  "ConfigRuleName":"cmk-backing-key-rotation-enabled",
  "Source":{"Owner":"AWS","SourceIdentifier":"CMK_BACKING_KEY_ROTATION_ENABLED"}}'

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
resource "aws_kms_key" "data_bucket" {
  description             = "CMK for regulated S3 buckets"
  deletion_window_in_days = 30
  enable_key_rotation     = true
  rotation_period_in_days = 365
}

# Detective complement: Config rule across the account.
resource "aws_config_config_rule" "cmk_rotation" {
  name = "cmk-backing-key-rotation-enabled"
  source {
    owner             = "AWS"
    source_identifier = "CMK_BACKING_KEY_ROTATION_ENABLED"
  }
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: AWS Config managed rule asserting automatic key rotation is enabled on all customer-managed CMKs.
Resources:
  KmsCmkRotationRule:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: cmk-backing-key-rotation-enabled
      Source:
        Owner: AWS
        SourceIdentifier: CMK_BACKING_KEY_ROTATION_ENABLED

Compliance mapping

fields @timestamp, eventName, requestParameters.keyId, userIdentity.arn, sourceIPAddress
          | filter eventSource = "kms.amazonaws.com" and eventName in ["DisableKeyRotation","EnableKeyRotation","ImportKeyMaterial","DeleteImportedKeyMaterial"]
          | sort @timestamp desc
          | limit 100

Equivalent on: Azure · GCP · OCI

Enable Amazon Macie at the AWS Organization level with a delegated administrator account, run sensitive-data discovery jobs on buckets in scope for PII/PCI/PHI classifications, and route findings to AWS Security Hub for triage and ticketing (Amazon Macie User Guide (accessed 2026-05)). Macie's value proposition is bounded: it discovers known sensitive-data patterns (US/EU PII, credit-card numbers, AWS credential material, common health-record markers) in S3 — it is not a general DLP, it does not block writes, and it does not see across services other than S3. As a detective complement to the preventive controls in aws-data-01..04, Macie closes the loop on accidental writes of PII into buckets the platform team did not designate as sensitive. Severity MEDIUM because Macie alone does not change the security posture; it changes the visibility into the posture, and visibility is what makes the preventive controls auditable.

Remediation — AWS CLI

# Org-level: delegate Macie admin to the security account.
aws macie2 enable-organization-admin-account \
  --admin-account-id 222233334444

# In the delegated admin: enable Macie and schedule a sensitive-data discovery job.
aws macie2 enable-macie --status ENABLED --finding-publishing-frequency FIFTEEN_MINUTES

aws macie2 create-classification-job \
  --job-type SCHEDULED \
  --schedule-frequency '{"DailySchedule":{}}' \
  --name "pii-discovery-regulated-buckets" \
  --s3-job-definition '{"bucketDefinitions":[
      {"accountId":"111122223333","buckets":["my-regulated-bucket"]}
    ]}'

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
resource "aws_macie2_account" "this" {
  finding_publishing_frequency = "FIFTEEN_MINUTES"
  status                       = "ENABLED"
}

resource "aws_macie2_organization_admin_account" "this" {
  admin_account_id = var.security_account_id
  depends_on       = [aws_macie2_account.this]
}

resource "aws_macie2_classification_job" "regulated" {
  job_type = "SCHEDULED"
  name     = "pii-discovery-regulated-buckets"

  s3_job_definition {
    bucket_definitions {
      account_id = data.aws_caller_identity.current.account_id
      buckets    = ["my-regulated-bucket"]
    }
  }

  schedule_frequency {
    daily_schedule = true
  }
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: Enable Amazon Macie in the account with continuous classification on a one-hour interval.
Resources:
  MacieSession:
    Type: AWS::Macie::Session
    Properties:
      FindingPublishingFrequency: ONE_HOUR
      Status: ENABLED

Compliance mapping

fields @timestamp, eventName, requestParameters.jobId, requestParameters.jobStatus, requestParameters.accountIds, userIdentity.arn
          | filter eventSource = "macie2.amazonaws.com" and eventName in ["DisableMacie","DeleteClassificationJob","UpdateClassificationJob","DisassociateMember","DeleteMember"]
          | sort @timestamp desc
          | limit 100

Equivalent on: Azure · GCP · OCI