Automated Sensitive Data Discovery - Configuration

The Configuration resource for automated sensitive data discovery provides access to configuration settings for performing automated sensitive data discovery, and the status of the configuration. To configure the settings or change the status of the configuration, you must be the Amazon Macie administrator for an organization or have a standalone Macie account.

If you enable automated sensitive data discovery, Macie continually evaluates your inventory of Amazon Simple Storage Service (Amazon S3) general purpose buckets and uses sampling techniques to identify and select representative objects in the buckets. Macie then retrieves and analyzes the selected objects, inspecting them for sensitive data. If you're the Macie administrator for an organization, by default this includes objects in buckets that your member accounts own.

You can monitor and review analyses' results in resource sensitivity profiles, statistical data, and other information that Macie produces and provides about your Amazon S3 data. These results are in addition to sensitive data findings, which report sensitive data that Macie finds in individual S3 objects, and sensitive data discovery results, which log details about the analysis of individual S3 objects. For more information, see Performing automated sensitive data discovery in the Amazon Macie User Guide.

To customize the analyses, change the configuration settings for your account. The settings include a classification scope and a sensitivity inspection template. The classification scope specifies S3 buckets that you want to exclude from analyses, such as buckets that typically store AWS logging data. The sensitivity inspection template specifies the allow lists, custom data identifiers, and managed data identifiers that you want Macie to use when it analyzes S3 objects. To change these settings, use the Classification Scope and Sensitivity Inspection Template resources.

If you're the Macie administrator for an organization, Macie uses the classification scope and sensitivity inspection template for your account when it analyzes data for other accounts in your organization. To refine the scope of the analyses, you have several options:

If you disable automated sensitive data discovery for your organization or standalone account, Macie retains your configuration settings. However, Macie stops performing all automated sensitive data discovery activities for your organization or account. In addition, you lose access to all resource sensitivity profiles, statistical data, and other information that Macie produced and directly provided about your Amazon S3 data while performing those activities. This doesn't include sensitive data findings. Macie stores findings for 90 days.

After you disable automated sensitive data discovery for your organization or standalone account, you can enable it again. Macie then resumes all automated sensitive data discovery activities for your organization or account. If you re-enable it within 30 days, you regain access to resource sensitivity profiles, statistical data, and other information that Macie previously produced and directly provided while performing those activities. If you don't re-enable it within 30 days, Macie permanently deletes these profiles and the statistical data and other information that it produced and directly provided.

If you're the Macie administrator for an organization or you have a standalone Macie account, you can use the Configuration resource to retrieve your current configuration settings for automated sensitive data discovery. You can also enable or disable automated sensitive data discovery for your organization or account.

URI

/automated-discovery/configuration

HTTP methods

GET

Operation ID: GetAutomatedDiscoveryConfiguration

Retrieves the configuration settings and status of automated sensitive data discovery for an organization or standalone account.

PUT

Operation ID: UpdateAutomatedDiscoveryConfiguration

Changes the configuration settings and status of automated sensitive data discovery for an organization or standalone account.

Schemas

Request bodies

{
  "autoEnableOrganizationMembers": enum,
  "status": enum
}

Response bodies

{
  "autoEnableOrganizationMembers": enum,
  "classificationScopeId": "string",
  "disabledAt": "string",
  "firstEnabledAt": "string",
  "lastUpdatedAt": "string",
  "sensitivityInspectionTemplateId": "string",
  "status": enum
}

{
}

{
  "message": "string"
}

{
  "message": "string"
}

{
  "message": "string"
}

{
  "message": "string"
}

Properties

AccessDeniedException

Provides information about an error that occurred due to insufficient access to a specified resource.

AutoEnableMode

Specifies whether to automatically enable automated sensitive data discovery for accounts that are part of an organization in Amazon Macie. Valid values are:

AutomatedDiscoveryStatus

The status of the automated sensitive data discovery configuration for an organization in Amazon Macie or a standalone Macie account. Valid values are:

Empty

The request succeeded and there isn't any content to include in the body of the response (No Content).

GetAutomatedDiscoveryConfigurationResponse

Provides information about the configuration settings and status of automated sensitive data discovery for an organization in Amazon Macie or a standalone Macie account.

InternalServerException

Provides information about an error that occurred due to an unknown internal server error, exception, or failure.

ThrottlingException

Provides information about an error that occurred because too many requests were sent during a certain amount of time.

UpdateAutomatedDiscoveryConfigurationRequest

Changes the configuration settings and status of automated sensitive data discovery for an organization in Amazon Macie or a standalone Macie account. To change additional settings, such as the managed data identifiers to use when analyzing data, update the sensitivity inspection template and classification scope for the organization's Macie administrator account or the standalone account.

ValidationException

Provides information about an error that occurred due to a syntax error in a request.

See also

For more information about using this API in one of the language-specific AWS SDKs and references, see the following:

GetAutomatedDiscoveryConfiguration

UpdateAutomatedDiscoveryConfiguration