Check Amazon Macie Is Enabled in Every Region

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadMacieStatus",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeRegions",
        "macie2:GetMacieSession",
        "macie2:GetAutomatedDiscoveryConfiguration",
        "macie2:GetBucketStatistics"
      ],
      "Resource": "*"
    },
    {
      "Sid": "EnableOnlyWithApply",
      "Effect": "Allow",
      "Action": "macie2:EnableMacie",
      "Resource": "*"
    },
    {
      "Sid": "MacieServiceLinkedRole",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "arn:aws:iam::*:role/aws-service-role/macie.amazonaws.com/AWSServiceRoleForAmazonMacie",
      "Condition": { "StringLike": { "iam:AWSServiceName": "macie.amazonaws.com" } }
    }
  ]
}

// check-macie-all-regions.ts
// Checks Amazon Macie in every enabled Region: session status, finding publishing frequency, automated
// sensitive data discovery and a bucket summary. --apply enables Macie where it isn't enabled yet.
// Usage:
//   npx tsx check-macie-all-regions.ts [--regions us-east-1,eu-west-1]
//   npx tsx check-macie-all-regions.ts --regions eu-west-1 --apply [--frequency ONE_HOUR]
import { randomUUID } from "node:crypto";
import { EC2Client, DescribeRegionsCommand } from "@aws-sdk/client-ec2";
import {
  Macie2Client,
  EnableMacieCommand,
  GetAutomatedDiscoveryConfigurationCommand,
  GetBucketStatisticsCommand,
  GetMacieSessionCommand,
  type FindingPublishingFrequency,
} from "@aws-sdk/client-macie2";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const apply = args.includes("--apply");
const FREQUENCIES = ["FIFTEEN_MINUTES", "ONE_HOUR", "SIX_HOURS"];
const frequencyArg = flag("--frequency");
if (frequencyArg && !FREQUENCIES.includes(frequencyArg)) {
  console.error(`--frequency must be one of ${FREQUENCIES.join(", ")}`);
  process.exit(1);
}
const frequency = frequencyArg as FindingPublishingFrequency | undefined;

interface Row {
  Region: string;
  Macie: string;
  Publishing: string;
  AutoDiscovery: string;
  Buckets: number | string;
  Public: number | string;
  NoDefaultEncryption: number | string;
  Sensitive: number | string;
}

const errName = (err: unknown): string => (err instanceof Error ? err.name : "Error");
const errText = (err: unknown): string => (err instanceof Error ? `${err.name}: ${err.message}` : String(err));

async function enabledRegions(): Promise<string[]> {
  const listed = flag("--regions");
  if (listed) return listed.split(",").map((r) => r.trim()).filter(Boolean);
  const ec2 = new EC2Client({ region: process.env.AWS_REGION ?? "us-east-1" });
  const out = await ec2.send(new DescribeRegionsCommand({ AllRegions: false }));
  return (out.Regions ?? []).map((r) => r.RegionName ?? "").filter(Boolean).sort();
}

async function checkRegion(region: string): Promise<{ row: Row; enabled: boolean }> {
  const macie = new Macie2Client({ region });
  const row: Row = {
    Region: region,
    Macie: "?",
    Publishing: "-",
    AutoDiscovery: "-",
    Buckets: "-",
    Public: "-",
    NoDefaultEncryption: "-",
    Sensitive: "-",
  };
  try {
    const session = await macie.send(new GetMacieSessionCommand({}));
    row.Macie = session.status ?? "UNKNOWN";
    row.Publishing = session.findingPublishingFrequency ?? "-";
  } catch (err) {
    // Without a Macie session the call fails with AccessDeniedException; so does a missing IAM permission.
    row.Macie = errName(err) === "AccessDeniedException" ? "NOT ENABLED" : `ERROR ${errName(err)}`;
    return { row, enabled: false };
  }
  try {
    const auto = await macie.send(new GetAutomatedDiscoveryConfigurationCommand({}));
    row.AutoDiscovery = auto.status ?? "UNKNOWN";
  } catch (err) {
    row.AutoDiscovery = `n/a (${errName(err)})`; // member accounts can't read the organization setting
  }
  try {
    const stats = await macie.send(new GetBucketStatisticsCommand({}));
    row.Buckets = stats.bucketCount ?? 0;
    row.Public = stats.bucketCountByEffectivePermission?.publiclyAccessible ?? 0;
    row.NoDefaultEncryption = stats.bucketCountByEncryptionType?.unencrypted ?? 0;
    row.Sensitive = stats.bucketStatisticsBySensitivity?.sensitive?.totalCount ?? 0;
  } catch (err) {
    row.Buckets = `n/a (${errName(err)})`;
  }
  return { row, enabled: true };
}

async function main(): Promise<void> {
  const regions = await enabledRegions();
  const rows: Row[] = [];
  const missing: string[] = [];
  for (const region of regions) {
    const { row, enabled } = await checkRegion(region);
    rows.push(row);
    if (!enabled && row.Macie === "NOT ENABLED") missing.push(region);
  }
  console.table(rows);
  const paused = rows.filter((r) => r.Macie === "PAUSED").map((r) => r.Region);
  const noAuto = rows.filter((r) => r.AutoDiscovery === "DISABLED").map((r) => r.Region);
  console.log(`${regions.length} Regions checked: ${missing.length} without Macie, ${paused.length} paused, ${noAuto.length} with automated discovery off.`);
  if (paused.length) console.log(`Paused (not re-enabled by this script): ${paused.join(", ")}`);

  if (!apply) {
    console.log("Report only: nothing was changed. Add --apply to enable Macie in the Regions marked NOT ENABLED.");
    return;
  }
  for (const region of missing) {
    const macie = new Macie2Client({ region });
    try {
      await macie.send(
        new EnableMacieCommand({ status: "ENABLED", clientToken: randomUUID(), findingPublishingFrequency: frequency }),
      );
      const check = await macie.send(new GetMacieSessionCommand({}));
      console.log(`Enabled Macie in ${region}: status ${check.status}, publishing ${check.findingPublishingFrequency}`);
    } catch (err) {
      console.error(`Could not enable Macie in ${region}: ${errText(err)}`);
      process.exitCode = 1;
    }
  }
}

main().catch((err) => {
  console.error(errText(err));
  process.exit(1);
});

npm install @aws-sdk/client-macie2 @aws-sdk/client-ec2
npm install --save-dev tsx typescript @types/node

# Report on every enabled Region
AWS_PROFILE=security-audit npx tsx check-macie-all-regions.ts

# Enable Macie in one Region, publishing finding updates hourly
AWS_PROFILE=security-admin npx tsx check-macie-all-regions.ts --regions eu-west-1 --apply --frequency ONE_HOUR

┌─────────┬──────────────┬───────────────┬───────────────────┬───────────────┬─────────┬────────┬─────────────────────┬───────────┐
│ (index) │ Region       │ Macie         │ Publishing        │ AutoDiscovery │ Buckets │ Public │ NoDefaultEncryption │ Sensitive │
├─────────┼──────────────┼───────────────┼───────────────────┼───────────────┼─────────┼────────┼─────────────────────┼───────────┤
│ 0       │ 'ap-south-1' │ 'PAUSED'      │ 'SIX_HOURS'       │ 'DISABLED'    │ 6       │ 0      │ 0                   │ 0         │
│ 1       │ 'eu-west-1'  │ 'NOT ENABLED' │ '-'               │ '-'           │ '-'     │ '-'    │ '-'                 │ '-'       │
│ 2       │ 'us-east-1'  │ 'ENABLED'     │ 'FIFTEEN_MINUTES' │ 'ENABLED'     │ 214     │ 2      │ 0                   │ 17        │
│ 3       │ 'us-west-2'  │ 'ENABLED'     │ 'SIX_HOURS'       │ 'DISABLED'    │ 38      │ 0      │ 0                   │ 0         │
└─────────┴──────────────┴───────────────┴───────────────────┴───────────────┴─────────┴────────┴─────────────────────┴───────────┘
4 Regions checked: 1 without Macie, 1 paused, 2 with automated discovery off.
Paused (not re-enabled by this script): ap-south-1
Enabled Macie in eu-west-1: status ENABLED, publishing ONE_HOUR