Amazon Macie, how often automated discovery run runs?

Question

Hi,

I have classification error in my coverage issues console in Amazon Macie, issue is Permission denied (9) - Update AWS KMS key policies. But KMS has all needed policies:

```
{
            "Sid": "Allow Macie to use the key",
            "Effect": "Allow",
            "Principal": {
                "Service": "macie.amazonaws.com"
            },
            "Action": [
                "kms:GenerateDataKey",
                "kms:Encrypt"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Allow the Macie service-linked role to use the key",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::account_id:role/aws-service-role/macie.amazonaws.com/AWSServiceRoleForAmazonMacie"
            },
            "Action": "kms:Decrypt",
            "Resource": "*"
        }
```

There is also info, that automated discovery run was running 2 weeks ago. How often automated discovery run runs? Does S3 buckets (that I scan) need also macie permissions?

I can't find that info.

Thank you

Accepted Answer

Hi there,

Macie Automated Data Discovery runs daily, but does not necessarily look at every bucket every day depending on how much content is scanned, how much as already been scanned, and what the sensitivity score is. For buckets with Permission Denied errors, it may take a few days to reflect after a KMS policy has been updated.

Two comments on the policy statement above:
* For the Principal ARN, can you confirm that you have the correct account ID in the real policy (instead of the accountID placeholder)?
* If this KMS key is being used cross account (key lives in account 123, bucket is in account 456), please see https://docs.aws.amazon.com/macie/latest/user/discovery-supported-encryption-types.html#discovery-supported-encryption-cmk-configuration for an additional policy statement that is required.

Macie should have permissions to the S3 buckets via the Service Linked Role (SLR). Note that if the bucket has any explicit "Deny" statements in the bucket policy, these will override the SLR - that might be worth checking as well.

Answer

aws:PrincipalAccount key means that all services from the account (include Macie) can access S3 bucket? That's strange as I have a lot of buckets Enter image description here

There is only classification error (not access denied). I have a lot of buckets with that Deny conditions above but Macie only complains about this bucket?

Amazon Macie, how often automated discovery run runs?

Relevant content