Amazon Macie Findings

01 Sign in to AWS Management Console.

02 Navigate to Amazon Macie console at https://console.aws.amazon.com/macie.

03 In the navigation panel, under Amazon Macie, choose Findings to access the page with the security findings identified within the current AWS cloud region.

04 On the Findings page, select All from the filter dropdown list, to view all the security findings identified by the Amazon Macie in the selected AWS region. If no findings are found in the verified region, the following confirmation message is shown: "You don't have any findings.". If one or more findings are displayed, there are Amazon Macie security findings that need to be solved within the current AWS region.

05 Change the AWS cloud region from the navigation bar and repeat the audit process for other regions.

01 Run list-findings command (OSX/Linux/UNIX) with custom query filters to describe the identifiers (IDs) of the Amazon Macie findings generated for the selected AWS cloud region:

aws macie2 list-findings
	--region ap-southeast-2
	--query 'findingIds'

02 The command output should return the ID(s) of the security finding(s) or an empty array (i.e. []) if there are no active security findings identified:

[
    "abcdabcd-1234-1234-1234-abcdabcdabcd",
    "abcd1234-abcd-1234-abcd-1234abcd1234",
    "1234abcd-1234-abcd-1234-abcd1234abcd"
]

03 Change the AWS cloud region by updating the --region command parameter value and repeat the entire audit process for other regions.

01 Sign in to AWS Management Console.

02 Navigate to Amazon Macie console at https://console.aws.amazon.com/macie.

03 In the navigation panel, under Amazon Macie, choose Findings.

04 On the Findings page, select All from the filter dropdown list, to view all the security findings identified by the Amazon Macie within the selected AWS region.

05 Click on the security finding that you want to analyze and resolve, to access the information generated for the selected Amazon Macie finding.

06 Once the finding description panel is open, review the selected entry by checking the most important attributes:

• For main section:
  1. Finding type – the type of the security finding, e.g. "Policy:IAMUser/S3BucketEncryptionDisabled". For example, if default encryption was enabled for an S3 bucket when you enabled Macie for your AWS account, and default encryption is later disabled for the bucket, then Amazon Macie generates a "Policy:IAMUser/S3BucketEncryptionDisabled" finding for the S3 bucket.
  2. Finding ID – the identifier (ID) of the security finding.
  3. Description – a detailed description of the finding, e.g. "Encryption is disabled for the Amazon S3 bucket. The data in the bucket isn't encrypted using server-side encryption."
• For Overview section:
  1. Severity – the severity label associated with the security finding, e.g. "Medium". Possible values are High, Medium, and Low.
  2. Region – the AWS cloud region where Amazon Macie generated the finding.
  3. Account ID – the ID number of the AWS account where the potential security issue described by the selected finding was found.
  4. Resource – the direct link to the affected AWS cloud resource.
• For Resources affected (S3 bucket) section:
  1. Bucket name – the name of the affected Amazon S3 bucket.
  2. Public access – the permissions settings that determine whether the bucket is publicly accessible.
  3. Encryption type – the S3 Server-Side Encryption algorithm used to encrypt data stored within the specified (affected) bucket. If encryption is disabled for the specified bucket, the Encryption type value is set to NONE.
  4. Owner – the display name and account identifier for the user who owns the affected bucket.

07 Based on the information reviewed at the previous step you can analyze the security finding and make a plan to implement the recommended fix. In this case, the remediation consists of enabling S3 Server-Side Encryption (S3 SSE) for the Amazon S3 bucket specified within the Amazon Macie finding details. To enable and configure Server-Side Encryption for the affected Amazon S3 bucket, follow the steps outlined in this conformity rule.

08 Repeat steps no. 5 – 7 for each Amazon Macie security finding identified within the current AWS region.

09 Change the AWS cloud region from the navigation bar and repeat the remediation process for other regions.

01 Run get-findings command (OSX/Linux/UNIX) using the ID of the Amazon Macie security finding that you want to examine as identifier parameter (see Audit section part II to identify the right entry), to retrieve the information available for the selected security finding:

aws macie2 get-findings
	--region ap-southeast-2
	--finding-ids abcdabcd-1234-abcd-1234-abcd1234abcd
	--query 'findings[*]'

02 The command output should return all the information available for the selected Amazon Macie finding:

[
    {
        "category": "POLICY",
        "count": 1,
        "archived": false,
        "title": "Encryption is disabled for the S3 bucket",
        "description": "Encryption is disabled for the Amazon S3 bucket. The data in the bucket isn’t encrypted using server-side encryption.",
        "severity": {
            "score": 2,
            "description": "Medium"
        },
        "region": "ap-southeast-2",
        "partition": "aws",
        "resourcesAffected": {
            "s3Bucket": {
                "name": "cc-candidate-data-bucket",
                "tags": [
                    {
                        "value": "HR",
                        "key": "Division"
                    },
                    {
                        "value": "Recruiting",
                        "key": "Team"
                    }
                ],
                "publicAccess": {
                    "effectivePermission": "NOT_PUBLIC"
                },
                "defaultServerSideEncryption": {
                    "encryptionType": "NONE"
                },
                "arn": "arn:aws:s3:::cc-candidate-data-bucket",
                "owner": {
                    "displayName": "cc-data-manager",
                    "id": "abcdabcdabcdabcdabcdabcdabcdabcd"
                },
                "createdAt": "2020-12-23T10:00:00.000Z"
            }
        },
        "policyDetails": {
            "action": {
                "apiCallDetails": {
                    "api": "PutBucketAcl",
                    "firstSeen": "2020-12-23T10:00:00.000Z",
                    "apiServiceName": "s3.amazonaws.com",
                    "lastSeen": "2020-12-23T10:00:00.000Z"
                },
                "actionType": "AWS_API_CALL"
            },
            "actor": {
                "userIdentity": {
                    "type": "AssumedRole",
                    "assumedRole": {
                        "sessionContext": {
                            "sessionIssuer": {
                                "userName": "RoleToBeAssumed",
                                "type": "Role",
                                "principalId": "ABCDABCDABCDABCDABCD",
                                "arn": "arn:aws:iam::123456789012:role/RoleToBeAssumed",
                                "accountId": "123456789012"
                            },
                            "attributes": {
                                "creationDate": "2020-12-20T11:00:00.000Z",
                                "mfaAuthenticated": false
                            }
                        },
                        "accountId": "123456789012",
                        "principalId": "ABCDABCDABCDABCDABCD:AssumedRoleSessionName",
                        "arn": "arn:aws:sts::123456789012:assumed-role/RoleToBeAssumed/MySessionName",
                        "accessKeyId": "ABCD1234ABCD1234ABCD"
                    }
                }
            }
        },
        "updatedAt": "2020-12-23T10:00:00.000Z",
        "schemaVersion": "1.0",
        "type": "Policy:IAMUser/S3BucketEncryptionDisabled",
        "id": "abcdabcd-1234-abcd-1234-abcd1234abcd",
        "createdAt": "2020-12-23T10:00:00.000Z",
        "accountId": "123456789012"
    }
]

03 For the get-findings command output returned at the previous step, review each security finding by analyzing its properties:

1. "type" - the type of the security finding, e.g. "Policy:IAMUser/S3BucketEncryptionDisabled". For example, if default encryption was enabled for an S3 bucket when you enabled Macie for your AWS account, and default encryption is later disabled for the bucket, then Amazon Macie generates a "Policy:IAMUser/S3BucketEncryptionDisabled" finding for the bucket.
2. "id" - the identifier (ID) of the security finding.
3. "title" - the title of the finding, e.g. "Encryption is disabled for the S3 bucket"
4. "description" - a detailed description of the finding, e.g. "Encryption is disabled for the Amazon S3 bucket. The data in the bucket isn't encrypted using server-side encryption."
5. "severity.description" - the severity label associated with the security finding, e.g. "Medium". Possible values are "High", "Medium", and "Low".
6. "region" - the AWS cloud region where Amazon Macie generated the finding, e.g. "ap-southeast-2".
7. "accountId" - the ID number of the AWS account where the potential security issue described by the selected finding was found.
8. "resourcesAffected.s3Bucket.name" - the name of the affected Amazon S3 bucket.
9. "resourcesAffected.s3Bucket.publicAccess" - the permissions settings that determine whether the bucket is publicly accessible.
10. "resourcesAffected.s3Bucket.defaultServerSideEncryption" - the S3 Server-Side Encryption algorithm used to encrypt data stored within the specified (affected) bucket. If encryption is disabled for the specified bucket, the "defaultServerSideEncryption.encryptionType" property value is set to "NONE".
11. "resourcesAffected.s3Bucket.owner" - the display name and account identifier for the user who owns the affected bucket.

04 Based on the information reviewed at the previous step you can analyze the security finding and make a plan to implement the recommended fix. In this case, the remediation consists of enabling S3 Server-Side Encryption (S3 SSE) for the Amazon S3 bucket specified within the Amazon Macie finding details. To enable and configure Server-Side Encryption for the affected Amazon S3 bucket, follow the steps outlined in this conformity rule.

05 Repeat steps no. 1 – 4 for each Amazon Macie security finding identified in the selected AWS region.

06 Change the AWS region by updating the --region command parameter value and repeat the entire remediation/resolution process for other regions.