🚔 Policing with Amazon Macie - Security & Compliance
Tags: security, cloud, beginners, tutorial
Published: 2022-02-24 01:41:12


## DAY 14 - Amazon Macie -  Security & Compliance - Day Fourteen


![Image Cover](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8pd07gne7yvrj18brfld.jpg)

[Tweet This Blog](https://link.anuvindh.com/twitter/DAY-14-AWS-macie-tweet.html)  - [100 days of Cloud on GitHub](https://github.com/anuvindhs/100daysofcloud) - [Read On iCTPro.co.nz](https://ictpro.co.nz)

-----

- Data on 123 Million US Households Exposed Due to Misconfigured AWS S3 Bucket - [**TrendMicro**] (https://www.trendmicro.com/vinfo/pl/security/news/virtualization-and-cloud/data-on-123-million-us-households-exposed-due-to-misconfigured-aws-s3-bucket) 

- Insecure Amazon S3 bucket exposed personal data on 500,000 Ghanaian graduates - [**Portswigger**](https://portswigger.net/daily-swig/insecure-amazon-s3-bucket-exposed-personal-data-on-500-000-ghanaian-graduates) 
- Leaky Buckets: 10 Worst Amazon S3 Breaches - [**Bitdefender**](https://businessinsights.bitdefender.com/worst-amazon-breaches)

Some of the biggest leaks on recent years , main reason for the **hacks** was misconfigured **S3 Buckets**. The best way to avoid your misconfiguration is to have proper monitoring and logging which is already provided by **AWS**.

## 👮 Policing your S3 infrastructure

![Image macie](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h7xm1go0s3g35ufg85o8.png)

{% embed https://twitter.com/awscloud/status/902309077094629380?lang=en %}.

A compliance and security service to automatically detect your unsecured data.

**Amazon Macie** gives you an  monitoring , alerting and protection of your S3 buckets. This tool will audit S3 buckets to find -
- Discover your sensitive data at scale
- Continual evaluation of your Amazon S3 environment
- Scalable on-demand and automated sensitive data discovery jobs
- Fully managed sensitive data types.
- Custom-defined sensitive data types.
- Multi-account support and integration with AWS organizations

- ML/Ai helps to finds access pattern.
- Assign business values in the form of risk score.
-  PII/PHI data protection.
- Alert on unauthorized ACL changes.
- Maintain Compliance requirement (**[GDPR](https://youtu.be/3x5IPj654Js)**).

Check out this [link](https://docs.aws.amazon.com/general/latest/gr/macie.html) to understand the availability for your regions.

Macie helps to get alerts on **Anonymized access , config compliance, credential loss, data compliance (PII,PHI), file hosting(malware detection), Identity Enumeration, information loss,  location anomaly, open permissions, privileged escalation, Ransomware,  Service disruption, suspicious access**.

## 🛠️ Enable Amazon Macie

### 📘 Knowledge Requirement
- S3 buckets 
- CloudTrail, enable CloudTrail

###🤖 The Macie

- Goto your console and search for **Amazon Macie**
- now click **Get Started**

![Image enablemaice](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gby6p0m1f6ygspgnkv8k.png)
- click on the enable Macie

![Image enablemiceclick](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/06t5oxt8a312j9vczg0r.png)

Thats it , now wait till **Amazon Macie** analyze your account.
After few minutes  it will give you a brief summery of your s3 buckets

![Image summary](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7xkv85jm79un9r0ki10c.png) 

##🪣 Configure your bucket

### Setup custom identifiers

Select **Custom data identifiers** and click **create**.
I am adding a custom data identifier for [SIRET-NICs data]
(https://aws.amazon.com/blogs/security/discover-sensitive-data-by-using-custom-data-identifiers-with-amazon-macie/). and click submit.
![Image SIRET-NICs](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/11htw2glf2uiuwx6e57g.png)

### Configure a Job

Now lets configure a bucket for Amazon Macie to police.
- On dashboard click s3 buckets and select your buck and click **Create Job**.
- Refine your scope, for this demo purpose am keeping it as **One-time job**. Click **Next**

![Image one-timejob](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u3i7ffybezt4eik1h27n.png)

- Now select your **Custom data identifier** & Click **Next**.
- Give a **Name and description** & Click **Next**.
- review and click **Submit**.

![Image results](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hm13zjjqycv7x77317fo.png)
tadaaaaa...

if you want to store results for long term , consider Configuring an S3 bucket of your sensitive data discovery results. this can be done in **Discovery results** under **Settings** menu.

### Overview of all buckets

- Select **buckets** from dashboard to see an overview

### Publication of findings

Macie automatically publishes all new and updated findings to Amazon EventBridge. You can configure Macie to publish findings to additional destinations, and specify how often to publish updates to all destinations.

![Image settings](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kn41867y6trn4cbrez76.png)

----------

**✅Connect with me on [Twitter](https://twitter.com/intent/follow?ref_src=anuvindhs&screen_name=anuvindhs)
 🤝🏽Connect with me on [Linkedin](https://www.linkedin.com/in/anuvindhs)
🧑🏼‍🤝‍🧑🏻 Read more post on [dev.to](https://dev.to/anuvindhs) or  [iCTPro.co.nz](https://ictpro.co.nz)
💻 Connect with me on [GitHub](https://github.com/anuvindhs)**


{% user anuvindhs %}

 {% devcomment https://dev.to/anuvindhs/comment/1majl %}