# Security in Macie Cloud security at AWS is the highest priority. As an AWS customer, you benefit from data centers and network architectures that are built to meet the requirements of the most security-sensitive organizations. Security is a shared responsibility between AWS and you. The [shared responsibility model](https://aws.amazon.com/compliance/shared-responsibility-model/) describes this as security *of* the cloud and security *in* the cloud: + **Security of the cloud** – AWS is responsible for protecting the infrastructure that runs AWS services in the AWS Cloud. AWS also provides you with services that you can use securely. Third-party auditors regularly test and verify the effectiveness of our security as part of the [AWS Compliance Programs](https://aws.amazon.com/compliance/programs/). To learn about the compliance programs that apply to Amazon Macie, see [AWS Services in Scope by Compliance Program](https://aws.amazon.com/compliance/services-in-scope/). + **Security in the cloud** – Your responsibility is determined by the AWS services that you use. You are also responsible for other factors including the sensitivity of your data, your company’s requirements, and applicable laws and regulations. This documentation helps you understand how to apply the shared responsibility model when using Amazon Macie. The following topics show you how to configure Macie to meet your security and compliance objectives. You also learn how to use other AWS services that can help you monitor and secure your Macie resources. **Topics** + [Data protection](data-protection.md) + [Identity and access management](security-iam.md) + [Compliance validation](compliance-validation.md) + [Resilience](disaster-recovery-resiliency.md) + [Infrastructure security](infrastructure-security.md) + [AWS PrivateLink](vpc-interface-endpoints-macie.md) # Data protection in Macie The AWS [shared responsibility model](https://aws.amazon.com/compliance/shared-responsibility-model/) applies to data protection in Amazon Macie. As described in this model, AWS is responsible for protecting the global infrastructure that runs all of the AWS Cloud. You are responsible for maintaining control over your content that is hosted on this infrastructure. You are also responsible for the security configuration and management tasks for the AWS services that you use. For more information about data privacy, see the [Data Privacy FAQ](https://aws.amazon.com/compliance/data-privacy-faq/). For information about data protection in Europe, see the [AWS Shared Responsibility Model and GDPR](https://aws.amazon.com/blogs/security/the-aws-shared-responsibility-model-and-gdpr/) blog post on the *AWS Security Blog*. For data protection purposes, we recommend that you protect AWS account credentials and set up individual users with AWS IAM Identity Center or AWS Identity and Access Management (IAM). That way, each user is given only the permissions necessary to fulfill their job duties. We also recommend that you secure your data in the following ways: + Use multi-factor authentication (MFA) with each account. + Use SSL/TLS to communicate with AWS resources. We require TLS 1.2 and recommend TLS 1.3. + Set up API and user activity logging with AWS CloudTrail. For information about using CloudTrail trails to capture AWS activities, see [Working with CloudTrail trails](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-trails.html) in the *AWS CloudTrail User Guide*. + Use AWS encryption solutions, along with all default security controls within AWS services. + Use advanced managed security services such as Amazon Macie, which assists in discovering and securing sensitive data that is stored in Amazon S3. + If you require FIPS 140-3 validated cryptographic modules when accessing AWS through a command line interface or an API, use a FIPS endpoint. For more information about the available FIPS endpoints, see [Federal Information Processing Standard (FIPS) 140-3](https://aws.amazon.com/compliance/fips/). We strongly recommend that you never put confidential or sensitive information, such as your customers' email addresses, into tags or free-form text fields such as a **Name** field. This includes when you work with Macie or other AWS services using the console, API, AWS CLI, or AWS SDKs. Any data that you enter into tags or free-form text fields used for names may be used for billing or diagnostic logs. If you provide a URL to an external server, we strongly recommend that you do not include credentials information in the URL to validate your request to that server. ## Encryption at rest Amazon Macie securely stores your data at rest using AWS encryption solutions. Macie encrypts data, such as findings, using an AWS managed key from AWS Key Management Service (AWS KMS). If you disable Macie, it permanently deletes all resources that it stores or maintains for you, such as sensitive data discovery jobs, custom data identifiers, and findings. ## Encryption in transit Amazon Macie encrypts all data in transit between AWS services. Macie analyzes data from Amazon S3 and exports sensitive data discovery results to an S3 general purpose bucket. After Macie gets the information that it needs from S3 objects, the objects are discarded. Macie accesses Amazon S3 by using a VPC endpoint powered by AWS PrivateLink. Therefore, traffic between Macie and Amazon S3 stays on the Amazon network and does not go over the public internet. For more information, see [AWS PrivateLink](https://aws.amazon.com/privatelink/). # Identity and access management for Macie AWS Identity and Access Management (IAM) is an AWS service that helps an administrator securely control access to AWS resources. IAM administrators control who can be *authenticated* (signed in) and *authorized* (have permissions) to use Macie resources. IAM is an AWS service that you can use with no additional charge. **Topics** + [Audience](#security_iam_audience) + [Authenticating with identities](#security_iam_authentication) + [Managing access using policies](#security_iam_access-manage) + [How Macie works with AWS Identity and Access Management](security_iam_service-with-iam.md) + [Identity-based policy examples for Macie](security_iam_id-based-policy-examples.md) + [AWS managed policies for Macie](security-iam-awsmanpol.md) + [Using service-linked roles for Macie](service-linked-roles.md) + [Troubleshooting identity and access management for Macie](security_iam_troubleshoot.md) ## Audience How you use AWS Identity and Access Management (IAM) differs based on your role: + **Service user** - request permissions from your administrator if you cannot access features (see [Troubleshooting identity and access management for Macie](security_iam_troubleshoot.md)) + **Service administrator** - determine user access and submit permission requests (see [How Macie works with AWS Identity and Access Management](security_iam_service-with-iam.md)) + **IAM administrator** - write policies to manage access (see [Identity-based policy examples for Macie](security_iam_id-based-policy-examples.md)) ## Authenticating with identities Authentication is how you sign in to AWS using your identity credentials. You must be authenticated as the AWS account root user, an IAM user, or by assuming an IAM role. You can sign in as a federated identity using credentials from an identity source like AWS IAM Identity Center (IAM Identity Center), single sign-on authentication, or Google/Facebook credentials. For more information about signing in, see [How to sign in to your AWS account](https://docs.aws.amazon.com/signin/latest/userguide/how-to-sign-in.html) in the *AWS Sign-In User Guide*. For programmatic access, AWS provides an SDK and CLI to cryptographically sign requests. For more information, see [AWS Signature Version 4 for API requests](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv.html) in the *IAM User Guide*. ### AWS account root user When you create an AWS account, you begin with one sign-in identity called the AWS account *root user* that has complete access to all AWS services and resources. We strongly recommend that you don't use the root user for everyday tasks. For tasks that require root user credentials, see [Tasks that require root user credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#root-user-tasks) in the *IAM User Guide*. ### Federated identity As a best practice, require human users to use federation with an identity provider to access AWS services using temporary credentials. A *federated identity* is a user from your enterprise directory, web identity provider, or Directory Service that accesses AWS services using credentials from an identity source. Federated identities assume roles that provide temporary credentials. For centralized access management, we recommend AWS IAM Identity Center. For more information, see [What is IAM Identity Center?](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html) in the *AWS IAM Identity Center User Guide*. ### IAM users and groups An *[IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html)* is an identity with specific permissions for a single person or application. We recommend using temporary credentials instead of IAM users with long-term credentials. For more information, see [Require human users to use federation with an identity provider to access AWS using temporary credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#bp-users-federation-idp) in the *IAM User Guide*. An [https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html) specifies a collection of IAM users and makes permissions easier to manage for large sets of users. For more information, see [Use cases for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/gs-identities-iam-users.html) in the *IAM User Guide*. ### IAM roles An *[IAM role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html)* is an identity with specific permissions that provides temporary credentials. You can assume a role by [switching from a user to an IAM role (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-console.html) or by calling an AWS CLI or AWS API operation. For more information, see [Methods to assume a role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage-assume.html) in the *IAM User Guide*. IAM roles are useful for federated user access, temporary IAM user permissions, cross-account access, cross-service access, and applications running on Amazon EC2. For more information, see [Cross account resource access in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html) in the *IAM User Guide*. ## Managing access using policies You control access in AWS by creating policies and attaching them to AWS identities or resources. A policy defines permissions when associated with an identity or resource. AWS evaluates these policies when a principal makes a request. Most policies are stored in AWS as JSON documents. For more information about JSON policy documents, see [Overview of JSON policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policies-json) in the *IAM User Guide*. Using policies, administrators specify who has access to what by defining which **principal** can perform **actions** on what **resources**, and under what **conditions**. By default, users and roles have no permissions. An IAM administrator creates IAM policies and adds them to roles, which users can then assume. IAM policies define permissions regardless of the method used to perform the operation. ### Identity-based policies Identity-based policies are JSON permissions policy documents that you attach to an identity (user, group, or role). These policies control what actions identities can perform, on which resources, and under what conditions. To learn how to create an identity-based policy, see [Define custom IAM permissions with customer managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) in the *IAM User Guide*. Identity-based policies can be *inline policies* (embedded directly into a single identity) or *managed policies* (standalone policies attached to multiple identities). To learn how to choose between managed and inline policies, see [Choose between managed policies and inline policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-choosing-managed-or-inline.html) in the *IAM User Guide*. ### Resource-based policies Resource-based policies are JSON policy documents that you attach to a resource. Examples include IAM *role trust policies* and Amazon S3 *bucket policies*. In services that support resource-based policies, service administrators can use them to control access to a specific resource. You must [specify a principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html) in a resource-based policy. Resource-based policies are inline policies that are located in that service. You can't use AWS managed policies from IAM in a resource-based policy. ### Other policy types AWS supports additional policy types that can set the maximum permissions granted by more common policy types: + **Permissions boundaries** – Set the maximum permissions that an identity-based policy can grant to an IAM entity. For more information, see [Permissions boundaries for IAM entities](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) in the *IAM User Guide*. + **Service control policies (SCPs)** – Specify the maximum permissions for an organization or organizational unit in AWS Organizations. For more information, see [Service control policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) in the *AWS Organizations User Guide*. + **Resource control policies (RCPs)** – Set the maximum available permissions for resources in your accounts. For more information, see [Resource control policies (RCPs)](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_rcps.html) in the *AWS Organizations User Guide*. + **Session policies** – Advanced policies passed as a parameter when creating a temporary session for a role or federated user. For more information, see [Session policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) in the *IAM User Guide*. ### Multiple policy types When multiple types of policies apply to a request, the resulting permissions are more complicated to understand. To learn how AWS determines whether to allow a request when multiple policy types are involved, see [Policy evaluation logic](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html) in the *IAM User Guide*. # How Macie works with AWS Identity and Access Management Before you use AWS Identity and Access Management (IAM) to manage access to Amazon Macie, learn which IAM features are available to use with Macie. **IAM features you can use with Macie** | IAM feature | Macie support | | --- | --- | | [Identity-based policies](#security_iam_service-with-iam-id-based-policies) | Yes | | [Resource-based policies](#security_iam_service-with-iam-resource-based-policies) | No | | [Policy actions](#security_iam_service-with-iam-id-based-policies-actions) | Yes | | [Policy resources](#security_iam_service-with-iam-id-based-policies-resources) | Yes | | [Policy condition keys](#security_iam_service-with-iam-id-based-policies-conditionkeys) | Yes | | [Access control lists (ACLs)](#security_iam_service-with-iam-acls) | No | | [Attribute-based access control (ABAC) – tags in policies](#security_iam_service-with-iam-tags) | Yes | | [Temporary credentials](#security_iam_service-with-iam-roles-tempcreds) | Yes | | [Forward access sessions (FAS)](#security_iam_service-with-iam-principal-permissions) | Yes | | [Service roles](#security_iam_service-with-iam-roles-service) | No | | [Service-linked roles](#security_iam_service-with-iam-roles-service-linked) | Yes | For a high-level view of how Macie and other AWS services work with most IAM features, see [AWS services that work with IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html) in the *IAM User Guide*. ## Identity-based policies for Macie **Supports identity-based policies:** Yes Identity-based policies are JSON permissions policy documents that you can attach to an identity, such as an IAM user, group of users, or role. These policies control what actions users and roles can perform, on which resources, and under what conditions. To learn how to create an identity-based policy, see [Define custom IAM permissions with customer managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) in the *IAM User Guide*. With IAM identity-based policies, you can specify allowed or denied actions and resources as well as the conditions under which actions are allowed or denied. To learn about all of the elements that you can use in a JSON policy, see [IAM JSON policy elements reference](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html) in the *IAM User Guide*. Amazon Macie supports identity-based policies. For examples, see [Identity-based policy examples for Macie](security_iam_id-based-policy-examples.md). ## Resource-based policies within Macie **Supports resource-based policies:** No Resource-based policies are JSON policy documents that you attach to a resource. Examples of resource-based policies are IAM *role trust policies* and Amazon S3 *bucket policies*. In services that support resource-based policies, service administrators can use them to control access to a specific resource. For the resource where the policy is attached, the policy defines what actions a specified principal can perform on that resource and under what conditions. You must [specify a principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html) in a resource-based policy. Principals can include accounts, users, roles, federated users, or AWS services. To enable cross-account access, you can specify an entire account or IAM entities in another account as the principal in a resource-based policy. For more information, see [Cross account resource access in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html) in the *IAM User Guide*. Amazon Macie doesn't support resource-based policies. That is to say, you can't attach a policy directly to a Macie resource. ## Policy actions for Macie **Supports policy actions:** Yes Administrators can use AWS JSON policies to specify who has access to what. That is, which **principal** can perform **actions** on what **resources**, and under what **conditions**. The `Action` element of a JSON policy describes the actions that you can use to allow or deny access in a policy. Include actions in a policy to grant permissions to perform the associated operation. Policy actions for Amazon Macie use the following prefix before the action: ``` macie2 ``` For example, to grant someone permission to access information about all the managed data identifiers that Macie provides, which is an action that corresponds to the `ListManagedDataIdentifiers` operation of the Amazon Macie API, include the `macie2:ListManagedDataIdentifiers` action in their policy: ``` "Action": "macie2:ListManagedDataIdentifiers" ``` To specify multiple actions in a single statement, separate them with commas. For example: ``` "Action": [ "macie2:ListManagedDataIdentifiers", "macie2:ListCustomDataIdentifiers" ] ``` You can also specify multiple actions by using wildcards (\$1). For example, to specify all actions that begin with the word `List`, include the following action: ``` "Action": "macie2:List*" ``` However, as a best practice, you should create policies that follow the principle of least privilege. In other words, you should create policies that include only the permissions that are required to perform a specific task. For a list of Macie actions, see [Actions defined by Amazon Macie](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmacie.html#amazonmacie-actions-as-permissions) in the *Service Authorization Reference*. For examples of policies that specify Macie actions, see [Identity-based policy examples for Macie](security_iam_id-based-policy-examples.md). ## Policy resources for Macie **Supports policy resources:** Yes Administrators can use AWS JSON policies to specify who has access to what. That is, which **principal** can perform **actions** on what **resources**, and under what **conditions**. The `Resource` JSON policy element specifies the object or objects to which the action applies. As a best practice, specify a resource using its [Amazon Resource Name (ARN)](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html). For actions that don't support resource-level permissions, use a wildcard (\$1) to indicate that the statement applies to all resources. ``` "Resource": "*" ``` Amazon Macie defines the following resource types: + Allow list + Custom data identifier + Filter or suppression rule, also referred to as a *findings filter* + Member account + Sensitive data discovery job, also referred to as a *classification job* You can specify these types of resources in policies by using ARNs. For example, to create a policy for the sensitive data discovery job that has the job ID *3ce05dbb7ec5505def334104bexample*, you can use the following ARN: ``` "Resource": "arn:aws:macie2:*:*:classification-job/3ce05dbb7ec5505def334104bexample" ``` Or, to specify all the sensitive data discovery jobs for a certain account, use a wildcard (\$1): ``` "Resource": "arn:aws:macie2:*:123456789012:classification-job/*" ``` Where *123456789012* is the account ID for the AWS account that created the jobs. As a best practice, however, you should create policies that follow the principle of least privilege. In other words, you should create policies that include only the permissions that are required to perform a specific task on a specific resource. Some Macie actions can apply to multiple resources. For example, the `macie2:BatchGetCustomDataIdentifiers` action can retrieve the details of multiple custom data identifiers. In these cases, a principal must have permissions to access all the resources that the action applies to. To specify multiple resources in a single statement, separate the ARNs with commas: ``` "Resource": [ "arn:aws:macie2:*:*:custom-data-identifier/12g4aff9-8e22-4f2b-b3fd-3063eexample", "arn:aws:macie2:*:*:custom-data-identifier/2d12c96a-8e78-4ca6-b1dc-8fd65example", "arn:aws:macie2:*:*:custom-data-identifier/4383a69d-4a1e-4a07-8715-208ddexample" ] ``` For a list of Macie resource types and the ARN syntax for each one, see [Resource types defined by Amazon Macie](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmacie.html#amazonmacie-resources-for-iam-policies) in the *Service Authorization Reference*. To learn which actions you can specify with each resource type, see [Actions defined by Amazon Macie](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmacie.html#amazonmacie-actions-as-permissions) in the *Service Authorization Reference*. For examples of policies that specify resources, see [Identity-based policy examples for Macie](security_iam_id-based-policy-examples.md). ## Policy condition keys for Macie **Supports service-specific policy condition keys:** Yes Administrators can use AWS JSON policies to specify who has access to what. That is, which **principal** can perform **actions** on what **resources**, and under what **conditions**. The `Condition` element specifies when statements execute based on defined criteria. You can create conditional expressions that use [condition operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html), such as equals or less than, to match the condition in the policy with values in the request. To see all AWS global condition keys, see [AWS global condition context keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html) in the *IAM User Guide*. For a list of Amazon Macie condition keys, see [Condition keys for Amazon Macie](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmacie.html#amazonmacie-policy-keys) in the *Service Authorization Reference*. To learn which actions and resources you can use a condition key with, see [Actions defined by Amazon Macie](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmacie.html#amazonmacie-actions-as-permissions). For examples of policies that use condition keys, see [Identity-based policy examples for Macie](security_iam_id-based-policy-examples.md). ## Access control lists (ACLs) in Macie **Supports ACLs:** No Access control lists (ACLs) control which principals (account members, users, or roles) have permissions to access a resource. ACLs are similar to resource-based policies, although they do not use the JSON policy document format. Amazon Simple Storage Service (Amazon S3) is an example of an AWS service that supports ACLs. To learn more, see [Access control list (ACL) overview](https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html) in the *Amazon Simple Storage Service User Guide*. Amazon Macie doesn't support ACLs. That is to say, you can't attach an ACL to a Macie resource. ## Attribute-based access control (ABAC) with Macie **Supports ABAC (tags in policies):** Yes Attribute-based access control (ABAC) is an authorization strategy that defines permissions based on attributes called tags. You can attach tags to IAM entities and AWS resources, then design ABAC policies to allow operations when the principal's tag matches the tag on the resource. To control access based on tags, you provide tag information in the [condition element](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html) of a policy using the `aws:ResourceTag/key-name`, `aws:RequestTag/key-name`, or `aws:TagKeys` condition keys. If a service supports all three condition keys for every resource type, then the value is **Yes** for the service. If a service supports all three condition keys for only some resource types, then the value is **Partial**. For more information about ABAC, see [Define permissions with ABAC authorization](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_attribute-based-access-control.html) in the *IAM User Guide*. To view a tutorial with steps for setting up ABAC, see [Use attribute-based access control (ABAC)](https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html) in the *IAM User Guide*. You can attach tags to Amazon Macie resources—allow lists, custom data identifiers, filter rules and suppression rules, member accounts, and sensitive data discovery jobs. You can also control access to these types of resources by providing tag information in the `Condition` element of a policy. For information about attaching tags to resources, see [Tagging Macie resources](tagging-resources.md). For an example of an identity-based policy that controls access to a resource based on tags, see [Identity-based policy examples for Macie](security_iam_id-based-policy-examples.md). ## Using temporary credentials with Macie **Supports temporary credentials:** Yes Temporary credentials provide short-term access to AWS resources and are automatically created when you use federation or switch roles. AWS recommends that you dynamically generate temporary credentials instead of using long-term access keys. For more information, see [Temporary security credentials in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) and [AWS services that work with IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html) in the *IAM User Guide*. Amazon Macie supports the use of temporary credentials. ## Forward access sessions for Macie **Supports forward access sessions (FAS):** Yes Forward access sessions (FAS) use the permissions of the principal calling an AWS service, combined with the requesting AWS service to make requests to downstream services. For policy details when making FAS requests, see [Forward access sessions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_forward_access_sessions.html). Amazon Macie makes FAS requests to downstream AWS services when you perform the following tasks: + Create or update Macie settings for an allow list that's stored in an S3 bucket. + Check the status of an allow list that's stored in an S3 bucket. + Retrieve sensitive data samples from an affected S3 object by using IAM user credentials. + Encrypt sensitive data samples that are retrieved using IAM user credentials or an IAM role. + Enable Macie to integrate with AWS Organizations. + Designate the delegated Macie administrator account for an organization in AWS Organizations. For other tasks, Macie uses a service-linked role to perform actions on your behalf. For details about this role, see [Using service-linked roles for Macie](service-linked-roles.md). ## Service roles for Macie **Supports service roles:** No A service role is an [IAM role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) that a service assumes to perform actions on your behalf. An IAM administrator can create, modify, and delete a service role from within IAM. For more information, see [Create a role to delegate permissions to an AWS service](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-service.html) in the *IAM User Guide*. Amazon Macie doesn't assume or use service roles. To perform actions on your behalf, Macie primarily uses a service-linked role. For details about this role, see [Using service-linked roles for Macie](service-linked-roles.md). ## Service-linked roles for Macie **Supports service-linked roles:** Yes A service-linked role is a type of service role that is linked to an AWS service. The service can assume the role to perform an action on your behalf. Service-linked roles appear in your AWS account and are owned by the service. An IAM administrator can view, but not edit the permissions for service-linked roles. Amazon Macie uses a service-linked role to perform actions on your behalf. For details about this role, see [Using service-linked roles for Macie](service-linked-roles.md). # Identity-based policy examples for Macie By default, users and roles don't have permission to create or modify Macie resources. To grant users permission to perform actions on the resources that they need, an IAM administrator can create IAM policies. To learn how to create an IAM identity-based policy by using these example JSON policy documents, see [Create IAM policies (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html) in the *IAM User Guide*. For details about actions and resource types defined by Macie, including the format of the ARNs for each of the resource types, see [Actions, resources, and condition keys for Amazon Macie](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmacie.html) in the *Service Authorization Reference*. When you create a policy, be sure to resolve security warnings, errors, general warnings, and suggestions from AWS Identity and Access Management Access Analyzer (IAM Access Analyzer) before you save the policy. IAM Access Analyzer runs policy checks to validate a policy against IAM [policy grammar](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_grammar.html) and [best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html). These checks generate findings and provide actionable recommendations to help you author policies that are functional and conform to security best practices. To learn about validating policies by using IAM Access Analyzer, see [IAM Access Analyzer policy validation](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-validation.html) in the *IAM User Guide*. To review a list of the warnings, errors, and suggestions that IAM Access Analyzer can return, see [IAM Access Analyzer policy check reference](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-reference-policy-checks.html) in the *IAM User Guide*. **Topics** + [Policy best practices](#security_iam_service-with-iam-policy-best-practices) + [Using the Amazon Macie console](#security_iam_id-based-policy-examples-console) + [Example: Allow users to review their own permissions](#security_iam_id-based-policy-examples-view-own-permissions) + [Example: Allow users to create sensitive data discovery jobs](#security_iam_id-based-policy-examples-create-job) + [Example: Allow users to manage a sensitive data discovery job](#security_iam_id-based-policy-examples-access-job) + [Example: Allow users to review findings](#security_iam_id-based-policy-examples-review-findings) + [Example: Allow users to review custom data identifiers based on tags](#security_iam_id-based-policy-examples-review-cdis-tags) ## Policy best practices Identity-based policies determine whether someone can create, access, or delete Macie resources in your account. These actions can incur costs for your AWS account. When you create or edit identity-based policies, follow these guidelines and recommendations: + **Get started with AWS managed policies and move toward least-privilege permissions** – To get started granting permissions to your users and workloads, use the *AWS managed policies* that grant permissions for many common use cases. They are available in your AWS account. We recommend that you reduce permissions further by defining AWS customer managed policies that are specific to your use cases. For more information, see [AWS managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies) or [AWS managed policies for job functions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html) in the *IAM User Guide*. + **Apply least-privilege permissions** – When you set permissions with IAM policies, grant only the permissions required to perform a task. You do this by defining the actions that can be taken on specific resources under specific conditions, also known as *least-privilege permissions*. For more information about using IAM to apply permissions, see [ Policies and permissions in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *IAM User Guide*. + **Use conditions in IAM policies to further restrict access** – You can add a condition to your policies to limit access to actions and resources. For example, you can write a policy condition to specify that all requests must be sent using SSL. You can also use conditions to grant access to service actions if they are used through a specific AWS service, such as CloudFormation. For more information, see [ IAM JSON policy elements: Condition](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html) in the *IAM User Guide*. + **Use IAM Access Analyzer to validate your IAM policies to ensure secure and functional permissions** – IAM Access Analyzer validates new and existing policies so that the policies adhere to the IAM policy language (JSON) and IAM best practices. IAM Access Analyzer provides more than 100 policy checks and actionable recommendations to help you author secure and functional policies. For more information, see [Validate policies with IAM Access Analyzer](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-validation.html) in the *IAM User Guide*. + **Require multi-factor authentication (MFA)** – If you have a scenario that requires IAM users or a root user in your AWS account, turn on MFA for additional security. To require MFA when API operations are called, add MFA conditions to your policies. For more information, see [ Secure API access with MFA](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html) in the *IAM User Guide*. For more information about best practices in IAM, see [Security best practices in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) in the *IAM User Guide*. ## Using the Amazon Macie console To access the Amazon Macie console, you must have a minimum set of permissions. These permissions must allow you to list and view details about the Macie resources in your AWS account. If you create an identity-based policy that is more restrictive than the minimum required permissions, the console won't function as intended for entities (users or roles) with that policy. You don't need to allow minimum console permissions for users that are making calls only to the AWS CLI or the AWS API. Instead, allow access to only the actions that match the API operation that they're trying to perform. To ensure that users and roles can use the Amazon Macie console, create IAM policies that provide them with console access. For more information, see [Policies and permissions in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *IAM User Guide*. If you create a policy that allows users or roles to use the Amazon Macie console, ensure that the policy allows the `macie2:GetMacieSession` action. Otherwise, those users or roles won't be able to access any Macie resources or data on the console. Also ensure that the policy allows the appropriate `macie2:List` actions for resources that those users or roles need to access on the console. Otherwise, they won't be able to navigate to or display details about those resources on the console. For example, to review the details of a sensitive data discovery job by using the console, a user must be allowed to perform the `macie2:DescribeClassificationJob` action for the job *and* the `macie2:ListClassificationJobs` action. If a user isn't allowed to perform the `macie2:ListClassificationJobs` action, the user won't be able to display a list of jobs on the **Jobs** page of the console, and therefore won't be able to choose the job to display its details. For the details to include information about a custom data identifier that the job uses, the user must also be allowed to perform the `macie2:BatchGetCustomDataIdentifiers` action for the custom data identifier. ## Example: Allow users to review their own permissions This example shows how you might create a policy that allows IAM users to view the inline and managed policies that are attached to their user identity. This policy includes permissions to complete this action on the console or programmatically using the AWS CLI or AWS API. ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "ViewOwnUserInfo", "Effect": "Allow", "Action": [ "iam:GetUserPolicy", "iam:ListGroupsForUser", "iam:ListAttachedUserPolicies", "iam:ListUserPolicies", "iam:GetUser" ], "Resource": ["arn:aws:iam::*:user/${aws:username}"] }, { "Sid": "NavigateInConsole", "Effect": "Allow", "Action": [ "iam:GetGroupPolicy", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:ListAttachedGroupPolicies", "iam:ListGroupPolicies", "iam:ListPolicyVersions", "iam:ListPolicies", "iam:ListUsers" ], "Resource": "*" } ] } ``` ## Example: Allow users to create sensitive data discovery jobs This example shows how you might create a policy that allows a user to create sensitive data discovery jobs. In the example, the first statement grants `macie2:CreateClassificationJob` permissions to the user. These permissions allow the user to create jobs. The statement also grants `macie2:DescribeClassificationJob` permissions. These permissions allow the user to access the details of existing jobs. Although these permissions aren't required to create jobs, access to these details can help the user create jobs that have unique configuration settings. The second statement in the example allows the user to create, configure, and review jobs by using the Amazon Macie console. The `macie2:ListClassificationJobs` permissions allow the user to display existing jobs on the **Jobs** page of the console. All other permissions in the statement allow the user to configure and create a job by using the **Create job** pages on the console. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "CreateAndReviewJobs", "Effect": "Allow", "Action": [ "macie2:CreateClassificationJob", "macie2:DescribeClassificationJob" ], "Resource": "arn:aws:macie2:*:*:classification-job/*" }, { "Sid": "CreateAndReviewJobsOnConsole", "Effect": "Allow", "Action": [ "macie2:ListClassificationJobs", "macie2:ListAllowLists", "macie2:ListCustomDataIdentifiers", "macie2:ListManagedDataIdentifiers", "macie2:SearchResources", "macie2:DescribeBuckets" ], "Resource": "*" } ] } ``` ------ ## Example: Allow users to manage a sensitive data discovery job This example shows how you might create a policy that allows a user to access the details of a particular sensitive data discovery job, the job whose ID is `3ce05dbb7ec5505def334104bexample`. The example also allows the user to change the status of the job as necessary. The first statement in the example grants `macie2:DescribeClassificationJob` and `macie2:UpdateClassificationJob` permissions to the user. These permissions allow the user to retrieve the job's details and change the job's status, respectively. The second statement grants `macie2:ListClassificationJobs` permissions to the user, which allows the user to access the job by using the **Jobs** page on the Amazon Macie console. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "ManageOneJob", "Effect": "Allow", "Action": [ "macie2:DescribeClassificationJob", "macie2:UpdateClassificationJob" ], "Resource": "arn:aws:macie2:*:*:classification-job/3ce05dbb7ec5505def334104bexample" }, { "Sid": "ListJobsOnConsole", "Effect": "Allow", "Action": "macie2:ListClassificationJobs", "Resource": "*" } ] } ``` ------ You might also allow the user to access logging data (*log events*) that Macie publishes to Amazon CloudWatch Logs for the job. To do this, you can add statements that grant permissions to perform CloudWatch Logs (`logs`) actions on the log group and stream for the job. For example: ``` { "Sid": "AccessLogGroupForMacieJobs", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:aws/macie/classificationjobs" }, { "Sid": "AccessLogEventsForOneMacieJob", "Effect": "Allow", "Action": "logs:GetLogEvents", "Resource": [ "arn:aws:logs:*:*:log-group:aws/macie/classificationjobs/*", "arn:aws:logs:*:*:log-group:aws/macie/classificationjobs:log-stream:3ce05dbb7ec5505def334104bexample" ] } ``` For information about managing access to CloudWatch Logs, see [Overview of managing access permissions to your CloudWatch Logs resources](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-access-control-overview-cwl.html) in the *Amazon CloudWatch Logs User Guide*. ## Example: Allow users to review findings This example shows how you might create a policy that allows a user to access findings data. In this example, the `macie2:GetFindings` and `macie2:GetFindingStatistics` permissions allow the user to retrieve the data by using the Amazon Macie API or the Amazon Macie console. The `macie2:ListFindings` permissions allow the user to retrieve and review the data by using the **Summary** dashboard and the **Findings** pages on the Amazon Macie console. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "ReviewFindings", "Effect": "Allow", "Action": [ "macie2:GetFindings", "macie2:GetFindingStatistics", "macie2:ListFindings" ], "Resource": "*" } ] } ``` ------ You might also allow the user to create and manage filter rules and suppression rules for findings. To do this, you might include a statement that grants the following permissions: `macie2:CreateFindingsFilter`, `macie2:GetFindingsFilter`, `macie2:UpdateFindingsFilter`, and `macie2:DeleteFindingsFilter`. To allow the user to manage the rules by using the Amazon Macie console, also include `macie2:ListFindingsFilters` permissions in the policy. For example: ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "ReviewFindings", "Effect": "Allow", "Action": [ "macie2:GetFindings", "macie2:GetFindingStatistics", "macie2:ListFindings" ], "Resource": "*" }, { "Sid": "ManageRules", "Effect": "Allow", "Action": [ "macie2:GetFindingsFilter", "macie2:UpdateFindingsFilter", "macie2:CreateFindingsFilter", "macie2:DeleteFindingsFilter" ], "Resource": "arn:aws:macie2:*:*:findings-filter/*" }, { "Sid": "ListRulesOnConsole", "Effect": "Allow", "Action": "macie2:ListFindingsFilters", "Resource": "*" } ] } ``` ------ ## Example: Allow users to review custom data identifiers based on tags In identity-based policies, you can use conditions to control access to Amazon Macie resources based on tags. This example shows how you might create a policy that allows a user to review custom data identifiers by using the Amazon Macie console or the Amazon Macie API. However, permission is granted only if the value for the `Owner` tag is the user's username. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "ReviewCustomDataIdentifiersIfOwner", "Effect": "Allow", "Action": "macie2:GetCustomDataIdentifier", "Resource": "arn:aws:macie2:*:*:custom-data-identifier/*", "Condition": { "StringEquals": {"aws:ResourceTag/Owner": "${aws:username}"} } }, { "Sid": "ListCustomDataIdentifiersOnConsoleIfOwner", "Effect": "Allow", "Action": "macie2:ListCustomDataIdentifiers", "Resource": "*", "Condition": { "StringEquals": {"aws:ResourceTag/Owner": "${aws:username}"} } } ] } ``` ------ In this example, if a user who has the username `richard-roe` attempts to review the details of a custom data identifier, the custom data identifier must be tagged `Owner=richard-roe` or `owner=richard-roe`. Otherwise, the user is denied access. The condition tag key `Owner` matches both `Owner` and `owner` because condition key names aren't case sensitive. For more information, see [IAM JSON policy elements: Condition](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html) in the *IAM User Guide*. # AWS managed policies for Macie An AWS managed policy is a standalone policy that is created and administered by AWS. AWS managed policies are designed to provide permissions for many common use cases so that you can start assigning permissions to users, groups, and roles. Keep in mind that AWS managed policies might not grant least-privilege permissions for your specific use cases because they're available for all AWS customers to use. We recommend that you reduce permissions further by defining [ customer managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#customer-managed-policies) that are specific to your use cases. You cannot change the permissions defined in AWS managed policies. If AWS updates the permissions defined in an AWS managed policy, the update affects all principal identities (users, groups, and roles) that the policy is attached to. AWS is most likely to update an AWS managed policy when a new AWS service is launched or new API operations become available for existing services. For more information, see [AWS managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies) in the *IAM User Guide*. Amazon Macie provides several AWS managed policies: the `AmazonMacieFullAccess` policy, the `AmazonMacieReadOnlyAccess` policy, and the `AmazonMacieServiceRolePolicy` policy. **Topics** + [AmazonMacieFullAccess policy](#security-iam-awsmanpol-AmazonMacieFullAccess) + [AmazonMacieReadOnlyAccess policy](#security-iam-awsmanpol-AmazonMacieReadOnlyAccess) + [AmazonMacieServiceRolePolicy policy](#security-iam-awsmanpol-AmazonMacieServiceRolePolicy) + [Updates to AWS managed policies for Macie](#security-iam-awsmanpol-updates) ## AWS managed policy: AmazonMacieFullAccess You can attach the `AmazonMacieFullAccess` policy to your IAM entities. This policy grants full administrative permissions that allow an IAM identity (*principal*) to create the [Amazon Macie service-linked role](service-linked-roles.md) and perform all read and write actions for Amazon Macie. The permissions include mutating functions such as create, update, and delete. If this policy is attached to a principal, the principal can create, retrieve, and otherwise access all Macie resources, data, and settings for their account. This policy must be attached to a principal before the principal can enable Macie for their account—a principal must be allowed to create the Macie service-linked role in order to enable Macie for their account. **Permissions details** This policy includes the following permissions: + `macie2` – Allows principals to perform all read and write actions for Amazon Macie. + `iam` – Allows principals to create service-linked roles. The `Resource` element specifies the service-linked role for Macie. The `Condition` element uses the `iam:AWSServiceName` [condition key](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html) and the `StringLike` [condition operator](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String) to restrict permissions to the service-linked role for Macie. + `pricing` – Allows principals to retrieve pricing data for their AWS account from AWS Billing and Cost Management. Macie uses this data to calculate and display estimated costs when principals create and configure sensitive data discovery jobs. To review the permissions for this policy, see [AmazonMacieFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonMacieFullAccess.html) in the *AWS Managed Policy Reference Guide*. ## AWS managed policy: AmazonMacieReadOnlyAccess You can attach the `AmazonMacieReadOnlyAccess` policy to your IAM entities. This policy grants read-only permissions that allow an IAM identity (*principal*) to perform all read actions for Amazon Macie. The permissions don't include mutating functions such as create, update, or delete. If this policy is attached to a principal, the principal can retrieve but not otherwise access all Macie resources, data, and settings for their account. **Permissions details** This policy includes the following permissions: `macie2` – Allows principals to perform all read actions for Amazon Macie. To review the permissions for this policy, see [AmazonMacieReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonMacieReadOnlyAccess.html) in the *AWS Managed Policy Reference Guide*. ## AWS managed policy: AmazonMacieServiceRolePolicy You can't attach the `AmazonMacieServiceRolePolicy` policy to your IAM entities. This policy is attached to a service-linked role that allows Amazon Macie to perform actions on your behalf. For more information, see [Using service-linked roles for Macie](service-linked-roles.md). To review the permissions for this policy, see [AmazonMacieServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonMacieServiceRolePolicy.html) in the *AWS Managed Policy Reference Guide*. ## Updates to AWS managed policies for Macie The following table provides details about updates to AWS managed policies for Amazon Macie since this service began tracking these changes. For automatic alerts about updates to the policies, subscribe to the RSS feed on the [Macie document history](doc-history.md) page. | Change | Description | Date | | --- | --- | --- | | [AmazonMacieReadOnlyAccess](#security-iam-awsmanpol-AmazonMacieReadOnlyAccess) – Added a new policy | Macie added a new policy, the `AmazonMacieReadOnlyAccess` policy. This policy grants read-only permissions that allow principals to retrieve all Macie resources, data, and settings for their account. | June 15, 2023 | | [AmazonMacieFullAccess](#security-iam-awsmanpol-AmazonMacieFullAccess) – Updated an existing policy | In the `AmazonMacieFullAccess` policy, Macie updated the Amazon Resource Name (ARN) of the Macie service-linked role (`aws-service-role/macie.amazonaws.com/AWSServiceRoleForAmazonMacie`). | June 30, 2022 | | [AmazonMacieServiceRolePolicy](service-linked-roles.md#slr-permissions) – Updated an existing policy | Macie removed actions and resources for Amazon Macie Classic from the `AmazonMacieServiceRolePolicy` policy. Amazon Macie Classic has been discontinued and is no longer available. More specifically, Macie removed all AWS CloudTrail actions. Macie also removed all Amazon S3 actions for the following resources: `arn:aws:s3:::awsmacie-*`, `arn:aws:s3:::awsmacietrail-*`, and `arn:aws:s3:::*-awsmacietrail-*`. | May 20, 2022 | | [AmazonMacieFullAccess](#security-iam-awsmanpol-AmazonMacieFullAccess) – Updated an existing policy | Macie added an AWS Billing and Cost Management (`pricing`) action to the `AmazonMacieFullAccess` policy. This action allows principals to retrieve pricing data for their account. Macie uses this data to calculate and display estimated costs when principals create and configure sensitive data discovery jobs. Macie also removed Amazon Macie Classic (`macie`) actions from the `AmazonMacieFullAccess` policy. | March 7, 2022 | | [AmazonMacieServiceRolePolicy](service-linked-roles.md#slr-permissions) – Updated an existing policy | Macie added Amazon CloudWatch Logs actions to the `AmazonMacieServiceRolePolicy` policy. These actions allow Macie to publish log events to CloudWatch Logs for sensitive data discovery jobs. | April 13, 2021 | | Macie started tracking changes | Macie started tracking changes for its AWS managed policies. | April 13, 2021 | # Using service-linked roles for Macie Amazon Macie uses an AWS Identity and Access Management (IAM) [service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html#id_roles_terms-and-concepts) named `AWSServiceRoleForAmazonMacie`. This service-linked role is an IAM role that's linked directly to Macie. It's predefined by Macie and it includes all the permissions that Macie requires to call other AWS services and monitor AWS resources on your behalf. Macie uses this service-linked role in all the AWS Regions where Macie is available. A service-linked role makes setting up Macie easier because you don't have to manually add the necessary permissions. Macie defines the permissions of this service-linked role, and unless defined otherwise, only Macie can assume the role. The defined permissions include the trust policy and the permissions policy, and that permissions policy can't be attached to any other IAM entity. For information about other services that support service-linked roles, see [AWS services that work with IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html) and look for the services that have **Yes** in the **Service-linked roles** column. Choose a **Yes** with a link to review the service-linked role documentation for that service. **Topics** + [Service-linked role permissions for Macie](#slr-permissions) + [Creating the Macie service-linked role](#create-slr) + [Editing the Macie service-linked role](#edit-slr) + [Deleting the Macie service-linked role](#delete-slr) + [Supported AWS Regions](#slr-regions) ## Service-linked role permissions for Macie Amazon Macie uses the service-linked role named `AWSServiceRoleForAmazonMacie`. This service-linked role trusts the `macie.amazonaws.com` service to assume the role. The permissions policy for the role, which is named `AmazonMacieServiceRolePolicy`, allows Macie to perform tasks such as the following on the specified resources: + Use Amazon S3 actions to retrieve information about S3 buckets and objects. + Use Amazon S3 actions to retrieve S3 objects. + Use AWS Organizations actions to retrieve information about associated accounts. + Use Amazon CloudWatch Logs actions to log events for sensitive data discovery jobs. To review the permissions for this policy, see [AmazonMacieServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonMacieServiceRolePolicy.html) in the *AWS Managed Policy Reference Guide*. For details about updates to this policy, see [Updates to AWS managed policies for Macie](security-iam-awsmanpol.md#security-iam-awsmanpol-updates). For automatic alerts about changes to this policy, subscribe to the RSS feed on the [Macie document history](doc-history.md) page. You must configure permissions for an IAM entity (such as a user or role) to allow the entity to create, edit, or delete a service-linked role. For more information, see [Service-linked role permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create-service-linked-role.html#service-linked-role-permissions) in the *IAM User Guide*. ## Creating the service-linked role for Macie You don't need to manually create the `AWSServiceRoleForAmazonMacie` service-linked role for Amazon Macie. When you enable Macie for your AWS account, Macie automatically creates the service-linked role for you. If you delete the Macie service-linked role and then need to create it again, you can use the same process to re-create the role in your account. When you enable Macie again, Macie creates the service-linked role again for you. ## Editing the service-linked role for Macie Amazon Macie doesn't allow you to edit the `AWSServiceRoleForAmazonMacie` service-linked role. After a service-linked role is created, you can't change the name of the role because various entities might reference the role. However, you can edit the description of the role by using IAM. For more information, see [Updating a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_update-service-linked-role.html) in the *IAM User Guide*. ## Deleting the service-linked role for Macie You can delete a service-linked role only after you delete its related resources. This protects your resources because you can't inadvertently remove permission to access the resources. If you no longer need to use Amazon Macie, we recommend that you manually delete the `AWSServiceRoleForAmazonMacie` service-linked role. When you disable Macie, Macie doesn't delete the role for you. Before you delete the role, you must disable Macie in each AWS Region where you enabled it. You must also manually clean up the resources for the role. To delete the role, you can use the IAM console, the AWS CLI, or the AWS API. For more information, see [Deleting a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage_delete.html#id_roles_manage_delete_slr) in the *IAM User Guide*. **Note** If Macie is using the `AWSServiceRoleForAmazonMacie` role when you try to delete the resources, the deletion might fail. If that happens, wait a few minutes and then try the operation again. If you delete the `AWSServiceRoleForAmazonMacie` service-linked role and need to create it again, you can create it again by enabling Macie for your account. When you enable Macie again, Macie creates the service-linked role again for you. ## Supported AWS Regions for the Macie service-linked role Amazon Macie supports using the `AWSServiceRoleForAmazonMacie` service-linked role in all the AWS Regions where Macie is available. For a list of Regions where Macie is currently available, see [Amazon Macie endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/macie.html) in the *AWS General Reference*. # Troubleshooting identity and access management for Macie The following information can help you diagnose and fix common issues that you might encounter when working with Amazon Macie and AWS Identity and Access Management (IAM). **Topics** + [I'm not authorized to perform an action in Macie](#security_iam_troubleshoot-no-permissions) + [I want to allow people outside my AWS account to access my Macie resources](#security_iam_troubleshoot-cross-account-access) ## I'm not authorized to perform an action in Macie If you receive an error that you're not authorized to perform an action, your policies must be updated to allow you to perform the action. The following example error occurs when the `mateojackson` IAM user tries to use the console to view details about a fictional `my-example-widget` resource but doesn't have the fictional `macie2:GetWidget` permissions. ``` User: arn:aws:iam::123456789012:user/mateojackson is not authorized to perform: macie2:GetWidget on resource: my-example-widget ``` In this case, the policy for the `mateojackson` user must be updated to allow access to the `my-example-widget` resource by using the `macie2:GetWidget` action. If you need help, contact your AWS administrator. Your administrator is the person who provided you with your sign-in credentials. ## I want to allow people outside my AWS account to access my Macie resources You can create a role that users in other accounts or people outside of your organization can use to access your resources. You can specify who is trusted to assume the role. For services that support resource-based policies or access control lists (ACLs), you can use those policies to grant people access to your resources. To learn more, consult the following: + To learn whether Macie supports these features, see [How Macie works with AWS Identity and Access Management](security_iam_service-with-iam.md). + To learn how to provide access to your resources across AWS accounts that you own, see [Providing access to an IAM user in another AWS account that you own](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_aws-accounts.html) in the *IAM User Guide*. + To learn how to provide access to your resources to third-party AWS accounts, see [Providing access to AWS accounts owned by third parties](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html) in the *IAM User Guide*. + To learn how to provide access through identity federation, see [Providing access to externally authenticated users (identity federation)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_federated-users.html) in the *IAM User Guide*. + To learn the difference between using roles and resource-based policies for cross-account access, see [Cross account resource access in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html) in the *IAM User Guide*. # Compliance validation for Macie To learn whether an AWS service is within the scope of specific compliance programs, see [AWS services in Scope by Compliance Program](https://aws.amazon.com/compliance/services-in-scope/) and choose the compliance program that you are interested in. For general information, see [AWS Compliance Programs](https://aws.amazon.com/compliance/programs/). You can download third-party audit reports using AWS Artifact. For more information, see [Downloading Reports in AWS Artifact](https://docs.aws.amazon.com/artifact/latest/ug/downloading-documents.html). Your compliance responsibility when using AWS services is determined by the sensitivity of your data, your company's compliance objectives, and applicable laws and regulations. For more information about your compliance responsibility when using AWS services, see [AWS Security Documentation](https://docs.aws.amazon.com/security/). # Resilience in Macie The AWS global infrastructure is built around AWS Regions and Availability Zones. Regions provide multiple physically separated and isolated Availability Zones, which are connected through low-latency, high-throughput, and highly redundant networking. With Availability Zones, you can design and operate applications and databases that automatically fail over between zones without interruption. Availability Zones are more highly available, fault tolerant, and scalable than traditional single or multiple data center infrastructures. For more information about AWS Regions and Availability Zones, see [AWS Global Infrastructure](https://aws.amazon.com/about-aws/global-infrastructure/). In addition to the AWS global infrastructure, Amazon Macie offers several features to help support your data resiliency and backup needs. For example, when you run a sensitive data discovery job or Macie performs automated sensitive data discovery, Macie automatically creates an analysis record for each Amazon Simple Storage Service (Amazon S3) object that's included in the scope of the analysis. These records, referred to as a *sensitive data discovery results*, log details about the analysis that Macie performs on individual S3 objects. This includes objects that Macie doesn't detect sensitive data in, and objects that Macie can't analyze due to errors or issues. Macie stores these results in an S3 bucket that you specify. For more information, see [Storing and retaining sensitive data discovery results](discovery-results-repository-s3.md). Macie also publishes policy and sensitive data findings to Amazon EventBridge as events. This includes new findings and updates to existing policy findings. (It doesn't include findings that you archive automatically using suppression rules.) By using EventBridge, you can send findings data to your preferred storage platform and store the data for as long as you like. Depending on publication settings that you choose, Macie can also publish policy and sensitive data findings to AWS Security Hub CSPM. For more information, see [Monitoring and processing Macie findings](findings-monitor.md). You also have the option of using Macie API operations to retrieve findings and other types of data programmatically. You can then process and send the data to your preferred storage platform, or another service, application, or system. For information about API operations that you might use to do this, see the [Amazon Macie API Reference](https://docs.aws.amazon.com/macie/latest/APIReference/welcome.html). # Infrastructure security in Macie As a managed service, Amazon Macie is protected by AWS global network security. For information about AWS security services and how AWS protects infrastructure, see [AWS Cloud Security](https://aws.amazon.com/security/). To design your AWS environment using the best practices for infrastructure security, see [Infrastructure Protection](https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/infrastructure-protection.html) in *Security Pillar AWS Well‐Architected Framework*. You use AWS published API calls to access Macie through the network. Clients must support the following: + Transport Layer Security (TLS). We require TLS 1.2 and recommend TLS 1.3. + Cipher suites with perfect forward secrecy (PFS) such as DHE (Ephemeral Diffie-Hellman) or ECDHE (Elliptic Curve Ephemeral Diffie-Hellman). Most modern systems such as Java 7 and later support these modes. You can call these API operations from any network location. However, if you use Amazon Virtual Private Cloud (Amazon VPC) to host your AWS resources, you can establish a private connection between your VPC and Macie by creating an interface endpoint. Interface endpoints are powered by [AWS PrivateLink](https://aws.amazon.com/privatelink/), a technology that enables you to privately access Macie without an internet gateway, NAT device, VPN connection, or Direct Connect connection. We create an endpoint network interface in each subnet that you enable for an interface endpoint. These are requester-managed network interfaces that can serve as the entry point for traffic destined for Macie. For more information, see [Access AWS services through AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-aws-services.html) in the *AWS PrivateLink Guide*. # Accessing Macie with an interface endpoint (AWS PrivateLink) You can use AWS PrivateLink to create a private connection between your virtual private cloud (VPC) and Amazon Macie. You can access Macie as if it were in your VPC, without the use of an internet gateway, NAT device, VPN connection, or Direct Connect connection. Instances in your VPC don't need public IP addresses to access Macie. You establish this private connection by creating an *interface endpoint*, powered by AWS PrivateLink. We create an endpoint network interface in each subnet that you enable for the interface endpoint. These are requester-managed network interfaces that serve as the entry point for traffic destined for Macie. For more information, see [Access AWS services through AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-aws-services.html) in the *AWS PrivateLink Guide*. **Topics** + [Considerations for Macie interface endpoints](#vpc-endpoint-considerations) + [Creating an interface endpoint for Macie](#vpc-endpoint-create) + [Creating an endpoint policy for Macie](#vpc-endpoint-policy) ## Considerations for Macie interface endpoints Amazon Macie supports interface endpoints in all the AWS Regions where it's currently available. For a list of these Regions, see [Amazon Macie endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/macie.html) in the *AWS General Reference*. Macie supports making calls to all of its API operations through interface endpoints. If you create an interface endpoint for Macie, consider doing the same for other AWS services that integrate with Macie and with AWS PrivateLink, such as Amazon EventBridge and AWS Security Hub CSPM. Macie and those services can then use the interface endpoints for the integration. For example, if you create an interface endpoint for Macie and an interface endpoint for Security Hub CSPM, Macie can use its interface endpoint when it publishes findings to Security Hub CSPM. Security Hub CSPM can use its interface endpoint when it receives the findings. For information about supported services, see [AWS services that integrate with AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/aws-services-privatelink-support.html) in the *AWS PrivateLink Guide*. ## Creating an interface endpoint for Macie You can create an interface endpoint for Amazon Macie by using the Amazon VPC console or the AWS Command Line Interface (AWS CLI). For more information, see [Create a VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html#create-interface-endpoint-aws) in the *AWS PrivateLink Guide*. When you create an interface endpoint for Macie, use the following service name: `com.amazonaws.region.macie2 ` Where *region* is the Region code for the applicable AWS Region. If you enable private DNS for the interface endpoint, you can make API requests to Macie using its default Regional DNS name, for example, `macie2.us-east-1.amazonaws.com` for the US East (N. Virginia) Region. ## Creating an endpoint policy for Macie An *endpoint policy* is an AWS Identity and Access Management (IAM) resource that you can attach to an interface endpoint. The default endpoint policy allows full access to Amazon Macie through the interface endpoint. To control the access allowed to Macie from your VPC, attach a custom endpoint policy to the interface endpoint. An endpoint policy specifies the following information: + The principals that can perform actions (AWS accounts, IAM users, and IAM roles). + The actions that can be performed. + The resources on which the actions can be performed. It's a separate policy for controlling access from the endpoint to the specified service. For more information, see [Control access to VPC endpoints using endpoint policies](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-access.html) in the *AWS PrivateLink Guide*. **Example: VPC endpoint policy for Macie actions** The following is an example of a custom endpoint policy for Macie. If you attach this policy to your interface endpoint, it grants access to the listed Macie actions for all principals on all resources. It allows users connecting to Macie through the VPC to access findings data by using the Amazon Macie API. ``` { "Statement": [ { "Principal": "*", "Effect": "Allow", "Action": [ "macie2:GetFindings", "macie2:GetFindingStatistics", "macie2:ListFindings" ], "Resource": "*" } ] } ``` To also allow users to access findings data or perform other actions by using the Amazon Macie console, the policy should also grant access to the `macie2:GetMacieSession` action, for example: ``` { "Statement": [ { "Principal": "*", "Effect": "Allow", "Action": [ "macie2:GetMacieSession", "macie2:GetFindings", "macie2:GetFindingStatistics", "macie2:ListFindings" ], "Resource": "*" } ] } ```