Automated Sensitive Data Discovery - Accounts

The Accounts resource for automated sensitive data discovery provides access to the status of automated sensitive data discovery for accounts that are centrally managed as an organization in Amazon Macie. If you're the Macie administrator for an organization, you can use this resource to check or change the status of automated sensitive data discovery for individual accounts in your organization. If you have a member account, you can use this resource to check the status of automated sensitive data discovery for your account. Contact your Macie administrator if you want to change the status.

If you're a Macie administrator, start by enabling automated sensitive data discovery for your organization. To enable it for your organization, use the Configuration resource for automated sensitive data discovery. By using that resource, you can also enable it automatically for all existing accounts and new member accounts, only new member accounts, or no accounts. After you enable it for your organization, you can manage the status of automated sensitive data discovery for individual accounts in your organization.

If automated sensitive data discovery is enabled for an account in an organization, Macie analyzes the account's Amazon Simple Storage Service (Amazon S3) data by using the configuration settings specified by the Macie administrator account for the organization:

As the analyses progress, Macie produces records of the sensitive data that it finds and the analysis that it performs: sensitive data findings, which report sensitive data that Macie finds in individual S3 objects, and sensitive data discovery results, which log details about the analysis of individual S3 objects. Macie also updates statistics, inventory data, and other information that it provides about Amazon S3 data. For more information, see Performing automated sensitive data discovery in the Amazon Macie User Guide.

As a Macie administrator, you can disable automated sensitive data discovery for an account at any time. If you disable it, Macie stops analyzing the account's Amazon S3 data. Instead of disabling it for an account completely, consider excluding only particular S3 buckets that the account owns. If you exclude a bucket, existing sensitive data discovery statistics and details for the bucket persist. For example, the bucket's current sensitivity score remains unchanged. However, Macie skips the bucket when it subsequently performs automated sensitive data discovery for the account. If you exclude a bucket, you can include it again later. To exclude or include a bucket, update the classification scope for your administrator account.

If you're the Macie administrator for an organization, you can use the Accounts resource to check or change the status of automated sensitive data discovery for individual accounts in your organization. If you have a member account, you can use this resource to check the status of automated sensitive data discovery for your account.

URI

/automated-discovery/accounts

HTTP methods

GET

Operation ID: ListAutomatedDiscoveryAccounts

Retrieves the status of automated sensitive data discovery for one or more accounts.

PATCH

Operation ID: BatchUpdateAutomatedDiscoveryAccounts

Changes the status of automated sensitive data discovery for one or more accounts.

Schemas

Request bodies

{
  "accounts": [
    {
      "accountId": "string",
      "status": enum
    }
  ]
}

Response bodies

{
  "items": [
    {
      "accountId": "string",
      "status": enum
    }
  ],
  "nextToken": "string"
}

{
  "errors": [
    {
      "accountId": "string",
      "errorCode": enum
    }
  ]
}

{
  "message": "string"
}

{
  "message": "string"
}

{
  "message": "string"
}

{
  "message": "string"
}

{
  "message": "string"
}

{
  "message": "string"
}

Properties

AccessDeniedException

Provides information about an error that occurred due to insufficient access to a specified resource.

AutomatedDiscoveryAccount

Provides information about the status of automated sensitive data discovery for an Amazon Macie account.

AutomatedDiscoveryAccountStatus

The status of automated sensitive data discovery for an Amazon Macie account. Valid values are:

AutomatedDiscoveryAccountUpdate

Changes the status of automated sensitive data discovery for an Amazon Macie account.

AutomatedDiscoveryAccountUpdateError

Provides information about a request that failed to change the status of automated sensitive data discovery for an Amazon Macie account.

AutomatedDiscoveryAccountUpdateErrorCode

The error code that indicates why a request failed to change the status of automated sensitive data discovery for an Amazon Macie account. Possible values are:

BatchUpdateAutomatedDiscoveryAccountsRequest

Changes the status of automated sensitive data discovery for one or more Amazon Macie accounts.

BatchUpdateAutomatedDiscoveryAccountsResponse

Provides the results of a request to change the status of automated sensitive data discovery for one or more Amazon Macie accounts.

ConflictException

Provides information about an error that occurred due to a versioning conflict for a specified resource.

InternalServerException

Provides information about an error that occurred due to an unknown internal server error, exception, or failure.

ListAutomatedDiscoveryAccountsResponse

Provides information about the status of automated sensitive data discovery for one or more Amazon Macie accounts.

ResourceNotFoundException

Provides information about an error that occurred because a specified resource wasn't found.

ThrottlingException

Provides information about an error that occurred because too many requests were sent during a certain amount of time.

ValidationException

Provides information about an error that occurred due to a syntax error in a request.

See also

For more information about using this API in one of the language-specific AWS SDKs and references, see the following:

ListAutomatedDiscoveryAccounts

BatchUpdateAutomatedDiscoveryAccounts