Disabling automated sensitive data discovery

Follow these steps to disable automated sensitive data discovery by using the Amazon Macie console.

If you use Macie in multiple Regions and want to disable automated sensitive data discovery in additional Regions, repeat the preceding steps in each additional Region.

With the Amazon Macie API, you can disable automated sensitive data discovery in two ways. How you disable it depends partly on the type of account that you have. If you're the Macie administrator for an organization, it also depends on whether you want to disable automated discovery for only particular member accounts or your organization overall. If you disable it for your organization, you disable it for all the accounts that are currently part of your organization. If additional accounts subsequently join your organization, automated discovery is also disabled for those accounts.

To disable automated sensitive data discovery for an organization or a standalone Macie account, use the UpdateAutomatedDiscoveryConfiguration operation. Or, if you're using the AWS Command Line Interface (AWS CLI), run the update-automated-discovery-configuration command. In your request, specify DISABLED for the status parameter.

To disable automated sensitive data discovery for only particular member accounts in an organization, use the BatchUpdateAutomatedDiscoveryAccounts operation. Or, if you're using the AWS CLI, run the batch-update-automated-discovery-accounts command. In your request, use the accountId parameter to specify the account ID for an account that you want to disable automated discovery for. For the status parameter, specify DISABLED. To disable automated discovery for an account, Macie must currently be enabled for the account.

The following examples show how to use the AWS CLI to disable automated sensitive data discovery for one or more accounts in an organization. This first example disables automated discovery for an organization. It disables automated discovery for the Macie administrator account and all member accounts in the organization.

$ aws macie2 update-automated-discovery-configuration --status DISABLED --region us-east-1

Where us-east-1 is the Region in which to disable automated sensitive data discovery for the organization, the US East (N. Virginia) Region. If the request succeeds, Macie disables automated discovery for the organization and returns an empty response.

These next examples disable automated sensitive data discovery for two member accounts in an organization. This example is formatted for Linux, macOS, or Unix, and it uses the backslash (\) line-continuation character to improve readability.

$ aws macie2 batch-update-automated-discovery-accounts \
--region us-east-1 \
--accounts '[{"accountId":"123456789012","status":"DISABLED"},{"accountId":"111122223333","status":"DISABLED"}]'

This example is formatted for Microsoft Windows and it uses the caret (^) line-continuation character to improve readability.

C:\> aws macie2 batch-update-automated-discovery-accounts ^
--region us-east-1 ^
--accounts=[{\"accountId\":\"123456789012\",\"status\":\"DISABLED\"},{\"accountId\":\"111122223333\",\"status\":\"DISABLED\"}]

Where:

If the request succeeds for all specified accounts, Macie returns an empty errors array. If the request fails for some accounts, the array specifies the error that occurred for each affected account. For example:

"errors": [
    {
        "accountId": "123456789012",
        "errorCode": "ACCOUNT_PAUSED"
    }
]

In the preceding response, the request failed for the specified account (123456789012) because Macie is currently suspended for the account.

If the request fails for all accounts, you receive a message that describes the error that occurred. For example:

An error occurred (ConflictException) when calling the BatchUpdateAutomatedDiscoveryAccounts operation: Cannot modify account states
while auto-enable is set to ALL.

In the preceding response, the request failed because the member enablement setting for the organization is currently configured to enable automated sensitive data discovery for all accounts (ALL). To address the error, the Macie administrator must first change this setting to NONE or NEW. For information about this setting, see Enabling automated sensitive data discovery.