> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Macie Should Be Enabled In Account Per Region.

### More Info:

This rule checks if Amazon Macie is enabled in your account per region. The rule is NON\_COMPLIANT if the status attribute is not set to ENABLED.

### Risk Level

High

### Address

Configuration

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of Macie not being enabled in the AWS account per region, you can follow these steps using the AWS Management Console:

        1. **Sign in to the AWS Management Console:**
           * Go to the AWS Management Console ([https://aws.amazon.com/console/](https://aws.amazon.com/console/)) and sign in to your account.

        2. **Navigate to Macie Service:**
           * In the AWS Management Console, search for "Macie" in the services search bar and select the Amazon Macie service.

        3. **Enable Macie in the Account:**
           * In the Macie dashboard, click on the "Get Started" button to enable Macie in your account.
           * Follow the on-screen instructions to set up Macie for your account. This may include configuring the Macie settings, such as choosing the regions where you want Macie to be enabled.

        4. **Enable Macie in Each Region:**
           * To enable Macie in each region, navigate to the Macie service in each region by selecting the region from the top right corner of the AWS Management Console.
           * Follow the same steps as mentioned in step 3 to enable Macie in each region where you want it to be enabled.

        5. **Verify Macie Configuration:**
           * Once Macie is enabled in the account and in each region, verify that the service is configured correctly by checking the Macie dashboard and settings in each region.

        6. **Monitor Macie Alerts:**
           * Set up alerts and notifications in Macie to monitor and receive alerts for any security findings or sensitive data discovery in your account.

        By following these steps, you can remediate the misconfiguration of Macie not being enabled in the AWS account per region and ensure that Macie is set up and configured correctly to help with data security and compliance in your AWS environment.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of Macie not being enabled in an AWS account per region, you can follow these steps using AWS CLI:

        Step 1: List the regions where Macie is not enabled in your AWS account

        ```bash theme={null}
        aws ec2 describe-regions --query "Regions[].RegionName" --output text | while read region; do aws macie2 describe-bucket-level-operations --region $region || echo "Macie not enabled in region $region"; done
        ```

        Step 2: Enable Macie in each region where it is not enabled

        ```bash theme={null}
        aws macie2 create-member --account-id YOUR_ACCOUNT_ID --region REGION_NAME
        ```

        Replace `YOUR_ACCOUNT_ID` with your AWS account ID and `REGION_NAME` with the specific region where Macie is not enabled.

        Step 3: Verify that Macie is now enabled in all regions

        ```bash theme={null}
        aws ec2 describe-regions --query "Regions[].RegionName" --output text | while read region; do aws macie2 describe-bucket-level-operations --region $region || echo "Macie not enabled in region $region"; done
        ```

        By following these steps using AWS CLI, you can remediate the misconfiguration of Macie not being enabled in an AWS account per region.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of Macie not being enabled in the AWS account per region using Python, you can follow these steps:

        1. Import the necessary Python libraries:

        ```python theme={null}
        import boto3
        ```

        2. Initialize the AWS Config and Macie clients:

        ```python theme={null}
        config_client = boto3.client('config')
        macie_client = boto3.client('macie2')
        ```

        3. Retrieve the list of AWS regions:

        ```python theme={null}
        regions = [region['RegionName'] for region in boto3.client('ec2').describe_regions()['Regions']]
        ```

        4. Enable Macie in each region if it is not already enabled:

        ```python theme={null}
        for region in regions:
            try:
                response = macie_client.describe_bucket(region=region)
            except macie_client.exceptions.ClientError as e:
                if e.response['Error']['Code'] == 'AccessDeniedException':
                    print(f"Macie is not enabled in region {region}. Enabling Macie in this region...")
                    try:
                        macie_client.create_member(accountId='current', email='youremail@example.com')
                        print(f"Macie has been enabled in region {region}.")
                    except macie_client.exceptions.ClientError as e:
                        print(f"Failed to enable Macie in region {region}. Error: {str(e)}")
                else:
                    print(f"Failed to describe Macie in region {region}. Error: {str(e)}")
        ```

        5. Run the Python script to enable Macie in all regions of the AWS account. Make sure you have the necessary permissions to enable Macie in the account.

        Please note that the above script assumes you have the necessary permissions to enable Macie in the AWS account. You may need to adjust the script based on your specific requirements and environment.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Enables Amazon Macie in the target AWS account for this region
        provider "aws" {
          region = "AWS_REGION_CODE" # e.g., "us-east-1"
        }

        resource "aws_macie2_account" "macie" {
          status = "ENABLED"

          # Optional: adjust as needed; does not affect the compliance check itself
          # Allowed values: "FIFTEEN_MINUTES", "ONE_HOUR", "SIX_HOURS"
          finding_publishing_frequency = "FIFTEEN_MINUTES"
        }
        ```

        Enabling Macie in a region creates/updates the Macie account configuration for that region and may incur costs; if Macie is centrally managed via AWS Organizations with a delegated Macie administrator, this resource must be applied from the delegated administrator account for member accounts.

        This change does not replace existing application resources, but it does enable a new managed service in the account/region.

        To verify, `terraform plan` should show creation (or update) of `aws_macie2_account.macie` with `status: "ENABLED"` for the configured provider region.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/config/latest/developerguide/macie-status-check.html](https://docs.aws.amazon.com/config/latest/developerguide/macie-status-check.html)