# 2.1.3 Ensure all data in Amazon S3 has been discovered, classified, and secured when necessary

- Source: https://support.icompaas.com/support/solutions/articles/62000233095-2-1-3-ensure-all-data-in-amazon-s3-has-been-discovered-classified-and-secured-when-necessary
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 2](https://support.icompaas.com/support/solutions/folders/62000169193)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## Profile Applicability:

Level 2

## Description:

Amazon S3 can store sensitive or regulated data, which should be:  
Discovered (Identified automatically)  
Monitored (Tracked for changes)  
Classified (Labelled as sensitive or non-sensitive)  
Protected (Secured against unauthorized access)

## Rationale:

-   Prevents data leaks by automatically detecting sensitive data.
    
-   Improves compliance with GDPR, HIPAA, PCI-DSS, and other frameworks.
    
-   Reduces human error through automated classification and monitoring.
    
-   Alerts security teams to sensitive data exposure before a breach occurs.
    

## Impact:

-   Amazon Macie has a cost based on scanned data volume.
    
-   Enabling Macie can increase AWS billing if analyzing large datasets.
    
-   May require additional IAM permissions for monitoring and classification.
    
-   Third-party data classification tools may have licensing fees.
    

## Default Value:

-   Amazon Macie is NOT enabled.
    
-   No built-in S3 discovery or classification runs automatically.
    
-   S3 objects are stored without automatic classification.
    

## Pre-Requisites:

1.  IAM permissions to enable Amazon Macie
    
    -   macie2:EnableMacie, macie2:CreateClassificationJob, s3:ListAllMyBuckets
        
2.  AWS CLI installed (for automation)
    
3.  Billing permissions (Macie is a paid service)
    
4.  IAM role for Macie to access S3 bucket
    

## Remediation:

### Test Plan:

## Using AWS Console

1.  Login to AWS Console → Open Macie Console: [Macie Console](https://console.aws.amazon.com/macie/)
    
2.  In the left-hand pane, click "By job" under Findings.
    

            ![](https://support.icompaas.com/assets/kb/a036f85a0113b728.png)

3.  Confirm that a data classification job exists for your S3 buckets
    
4.  If no jobs are configured, remediation is required.
    

## Using AWS CLI

Step 1: Check if Macie is enabled

aws macie2 get-macie-session

Example Output (Macie Enabled)

{
    "status": "ENABLED",
    "findingPublishingFrequency": "FIFTEEN\_MINUTES",
    "serviceRole": "arn:aws:iam::123456789012:role/AWSServiceRoleForAmazonMacie"
}

Example Output (Macie NOT Enabled)

{
    "status": "PAUSED"
}

Step 2: Check Existing Macie Jobs for S3 Scanning

aws macie2 list-classification-jobs

Example Output (Macie Jobs Exist)

{
    "jobs": \[
        {
            "jobId": "12345678-abcd-efgh-ijkl-987654321000",
            "name": "S3-Sensitive-Data-Scan",
            "status": "RUNNING"
        }
    \]
}

## Implementation Steps:

## Using AWS Console

1.  Log in to the [Macie Console](https://console.aws.amazon.com/macie/).
    
2.  Click "Get Started", then click "Enable Macie".
    

             ![](https://support.icompaas.com/assets/kb/d31753c235798555.png)

3.  Configure Data Discovery Results:
    
    -   Under Settings → Discovery results, create an S3 bucket to store results.
        
    -   Enable KMS encryption for added security.
        

              ![](https://support.icompaas.com/assets/kb/1397729ea4303361.png)

4.  Create a Macie Classification Job:
    
    -   Go to "S3 Buckets" and select buckets to scan.               
        

                         ![](https://support.icompaas.com/assets/kb/eb053f32a5dab2f6.png)

-   Click "Create Job" → Quick Create → Enter a job name.                      ![](https://support.icompaas.com/assets/kb/725e8014cccee728.png)                      
    
-   Click "Next" → "Submit".
    

                             ![](https://support.icompaas.com/assets/kb/3292da40f9e93078.png)

5.  Monitor Findings:
    
    -   Go to "Findings" in Macie to review sensitive data alerts.
        

                 ![](https://support.icompaas.com/assets/kb/24a90fa27aa28d40.png)

## Using AWS CLI

Step 1: Enable Macie

aws macie2 enable-macie

Step 2: Create an S3 Data Classification Job

aws macie2 create-classification-job \\
    --job-type ONE\_TIME \\
    --name "S3-Sensitive-Data-Scan" \\
    --s3-job-definition bucketDefinitions=\[{bucketName="my-secure-bucket"}\]

  

Backout Plan:

If Macie costs become too high or false positives impact operations, follow these steps:

Step 1: Disable Macieaws macie2 disable-macie

Step 2: Delete Unused Macie Jobs

aws macie2 delete-classification-job --job-id <job\_id>

References:

-   [Amazon Macie Documentation](https://docs.aws.amazon.com/macie/latest/user/data-classification.html)
    
-   [Macie Getting Started Guide](https://aws.amazon.com/macie/getting-started/)
    
-   [S3 Data Security Best Practices](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.