Skip to content
FedRAMP Rules Hub
JSON — GET /api/aws-evidence

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

Control index

A Region-by-Region inventory of the resources that can hold information, the classification tags you asserted on them, and — where Macie exists — a sampled machine judgement about which S3 buckets actually contain sensitive data

JSON — GET /api/aws-evidenceMD — /collect/information-location-and-classification.md — this page as markdown, for pasting into an agent

The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.

partial — needs judgementclimonthlyAWS ConfigAWS Resource Groups Tagging APIAmazon MacieAmazon S3

Fetch

$ aws configservice select-aggregate-resource-config --configuration-aggregator-name <ORG_AGGREGATOR> --expression "SELECT awsRegion, resourceType, COUNT(*) WHERE resourceType IN ('AWS::S3::Bucket', 'AWS::RDS::DBInstance', 'AWS::DynamoDB::Table', 'AWS::EFS::FileSystem') GROUP BY awsRegion, resourceType"
$ aws resourcegroupstaggingapi get-resources --tag-filters Key=DataClassification --region us-gov-west-1
$ aws macie2 get-automated-discovery-configuration
$ aws macie2 describe-buckets --query 'buckets[].{bucket:bucketName,region:region,score:sensitivityScore,monitored:automatedDiscoveryMonitoringStatus,lastAnalyzed:lastAutomatedDiscoveryTime,unclassifiable:unclassifiableObjectCount.total}'

Expected output

A per-Region, per-type count of information-bearing resources across every account in the aggregator — aggregation queries page at 500 rows by default and plain SELECTs at 25, so page or raise --max-results before treating a result set as the whole estate. Then a ResourceTagMappingList of ARNs carrying your DataClassification key, one Region per call. Then Macie's status ENABLED or DISABLED with firstEnabledAt, lastUpdatedAt, classificationScopeId and sensitivityInspectionTemplateId; and per bucket a sensitivityScore — documented as -1 for a classification error, 1 for an empty bucket, 50 for a bucket excluded from recent analyses, up to 100 for sensitive — alongside automatedDiscoveryMonitoringStatus MONITORED or NOT_MONITORED, lastAutomatedDiscoveryTime and the unclassifiable object count

Map — what it proves

  • recipe2
Key Security Indicators
KSI-PIY-GIVKSI-SVC-EIS
NIST 800-53 controls
recipe · 1 recipeCM-12recipe · 1 recipeCM-12 (01)
  • recipe— an authored recipe collects evidence for this control
  • KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
  • orphan— no Key Security Indicator reaches it — a person writes it up instead

What else these families can fetch:CM 14/34 →

Submits toward

MAS-CSO-IIRIdentify Information ResourcesMUST
  • A machine readable output containing all required data of the components of the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.
  • A human readable explanation of how the machine readable output is derived.
  • The code for the automated process used to generate the machine readable output.
MAS-CSO-MDIMetadata InclusionMUST
  • A machine readable output containing all required data of the metadata collected or maintained by the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.
  • A human readable explanation of how the machine readable output is derived.
  • The code for the automated process used to generate the machine readable output.

This recipe’s output is the machine-readable half. The human readable derivation and the collector’s own code are artifacts you still owe — the rule demands all three.

GovCloud

Amazon Macie is not available in AWS GovCloud (US): the AWS General Reference lists no macie2 endpoint for us-gov-east-1 or us-gov-west-1, and the macie-status-check Config rule is excluded from both GovCloud Regions. In GovCloud the last two commands have nothing to call and CM-12(1)'s automated identification by information type needs another tool. The first two do work — AWS Config in both Regions, and the Resource Groups Tagging API at tagging.us-gov-east-1.amazonaws.com and tagging.us-gov-west-1.amazonaws.com — but Config in GovCloud does not record third-party or custom resource types, so anything you model that way is invisible to the aggregate query. ARNs use partition arn:aws-us-gov

Notes & assertions

Three different qualities of evidence are stacked here, and conflating them is the trap. The Config aggregate query is solid on where storage lives — resource type by Region, across accounts — and that is the part of CM-12 most often undocumented. The tag query is only as true as your tagging: GetResources by design never returns untagged resources, so an unclassified bucket is absent from the answer rather than flagged, which is precisely backwards for an inventory control; run it beside the aggregate count and treat the difference as your unclassified population. Macie is the only machine-derived opinion about information type, and it is a sample rather than a census — automated sensitive data discovery continually selects representative objects from your buckets and scores each bucket from those, so a MONITORED bucket with a low score means ‘nothing sensitive in what was sampled’, never ‘no sensitive data here’. The unclassifiable object count is the population Macie could not read at all because of storage class or file format, and per-file size quotas mean a large archive can be skipped entirely, so read coverage before reading scores. Macie also only looks at S3: nothing above inspects an RDS table, an EFS volume, a DynamoDB item or a Parameter Store value, and the Region field tells you where a bucket is, which is the CM-12 question, not what is in it. What no command produces is CM-12 itself — the documented location of each information type, the users authorized to access it and the purpose it is held for. That is a record you write and then check against this telemetry, not one you derive from it.

References

This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.

The Policy and Inventory run (4)

  • automatable
  • partial — needs judgement
  • narrative — no API proves this

Every authored recipe filed under PIY, in the order the plan works them. The mark says how much of the evidence the command produces on its own.