Macie automated sensitive data discovery should be enabled

How to fix it

Turn automated sensitive data discovery on for Macie in the named region, so it samples the S3 buckets there and reports where sensitive data sits. Macie itself has to be enabled in that region first. In an organization the Macie administrator account controls this for its members, so if this account is a member the change is made there and not here; this check cannot tell the two apart. Sampling bills by the volume of S3 data inspected, and can be narrowed to exclude specific buckets rather than left off.

In the console

Amazon Macie → Settings → Automated sensitive data discovery

With the AWS CLI

aws macie2 update-automated-discovery-configuration --status ENABLED --region <region>