AWSConfig - macie2.amazonaws.com AccessDenied when macie not enabled.

[mikereiddigital]

Expected Behavior

The nightly AWSConfig job should run without error. This is defined here - https://github.com/ministryofjustice/modernisation-platform-terraform-baselines/tree/1f1fc92e9702580a44a9f965f2cf77807f70db36/modules/config

Actual Behavior

The nightly run throws an AccessDenied error in those accounts where macie is not configured. See the following cloudtrail events as examples:

23ddb7cd-9694-47fa-b5e0-47f9e0cf78d2

and

77754602-5752-48ca-90ed-6aedcb56c5bf

This is a known issue re https://repost.aws/questions/QU8ZC1xd9BQV2vnGkod7gQww/macie-not-enabled-means-false-positive-accessdeniedexceptions-in-cloudtrail

The above link also offers some guidance as to how this can be resolved / mitigated.

Steps to Reproduce the Problem

AWSConfig runs nightly.

Version

No response

Modules

https://github.com/ministryofjustice/modernisation-platform-terraform-baselines/tree/1f1fc92e9702580a44a9f965f2cf77807f70db36/modules/config

Account

modernisation-platform

[SimonPPledger]

we want to remove macie instead, so close this ticket and create a new one

[SimonPPledger]

closing as not required