Amazon Macie Rollout Checklist: Cost Controls and Finding Triage

Retrospective: this article looks back at events from August 2017, written in 2026 with the benefit of hindsight.

Use this checklist before and after enabling Amazon Macie to get value quickly while keeping costs predictable.

Before you enable

• A delegated administrator account is chosen for Macie in AWS Organizations.
• Each business unit has a named data owner for its S3 buckets.
• You have estimated total S3 storage per account to understand potential scan costs.
• You have decided where findings go (Security Hub, ticketing, SIEM).

Configuration

• Macie is enabled in every region where you store data, not just your main region.
• Automated sensitive data discovery is turned on.
• Custom data identifiers are defined for company-specific sensitive data formats.
• Allow lists exclude known test data and synthetic records.
• Targeted discovery jobs are scheduled only for high-value buckets.

Cost controls

• Jobs exclude file types that do not need scanning.
• Sampling depth is set for large buckets.
• An AWS Budgets alert covers Macie spend.

Finding triage

• Public or externally shared buckets with sensitive data are treated as high priority.
• Unencrypted buckets containing sensitive data are remediated.
• Buckets with sensitive data and no owner are escalated.
• Findings are reviewed weekly until the backlog is cleared, then monthly.

Ongoing

• New accounts are enrolled automatically.
• Discovery results feed your data inventory and retention decisions.