# A Region-by-Region inventory of the resources that can hold information, the classification tags you asserted on them, and — where Macie exists — a sampled machine judgement about which S3 buckets actually contain sensitive data

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/information-location-and-classification

Recipe id: `information-location-and-classification` · cadence monthly · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-PIY-GIV`
- KSI `KSI-SVC-EIS`
- control `cm-12`
- control `cm-12.1`

## Collection

Kind: `cli`

```sh
# select-aggregate-resource-config
aws configservice select-aggregate-resource-config --configuration-aggregator-name <ORG_AGGREGATOR> --expression "SELECT awsRegion, resourceType, COUNT(*) WHERE resourceType IN ('AWS::S3::Bucket', 'AWS::RDS::DBInstance', 'AWS::DynamoDB::Table', 'AWS::EFS::FileSystem') GROUP BY awsRegion, resourceType"
# get-resources
aws resourcegroupstaggingapi get-resources --tag-filters Key=DataClassification --region us-gov-west-1
# get-automated-discovery-configuration
aws macie2 get-automated-discovery-configuration
# describe-buckets
aws macie2 describe-buckets --query 'buckets[].{bucket:bucketName,region:region,score:sensitivityScore,monitored:automatedDiscoveryMonitoringStatus,lastAnalyzed:lastAutomatedDiscoveryTime,unclassifiable:unclassifiableObjectCount.total}'
```

## Expected output

A per-Region, per-type count of information-bearing resources across every account in the aggregator — aggregation queries page at 500 rows by default and plain SELECTs at 25, so page or raise --max-results before treating a result set as the whole estate. Then a ResourceTagMappingList of ARNs carrying your DataClassification key, one Region per call. Then Macie's status ENABLED or DISABLED with firstEnabledAt, lastUpdatedAt, classificationScopeId and sensitivityInspectionTemplateId; and per bucket a sensitivityScore — documented as -1 for a classification error, 1 for an empty bucket, 50 for a bucket excluded from recent analyses, up to 100 for sensitive — alongside automatedDiscoveryMonitoringStatus MONITORED or NOT_MONITORED, lastAutomatedDiscoveryTime and the unclassifiable object count

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

Amazon Macie is not available in AWS GovCloud (US): the AWS General Reference lists no macie2 endpoint for us-gov-east-1 or us-gov-west-1, and the macie-status-check Config rule is excluded from both GovCloud Regions. In GovCloud the last two commands have nothing to call and CM-12(1)'s automated identification by information type needs another tool. The first two do work — AWS Config in both Regions, and the Resource Groups Tagging API at tagging.us-gov-east-1.amazonaws.com and tagging.us-gov-west-1.amazonaws.com — but Config in GovCloud does not record third-party or custom resource types, so anything you model that way is invisible to the aggregate query. ARNs use partition arn:aws-us-gov

## Notes

Three different qualities of evidence are stacked here, and conflating them is the trap. The Config aggregate query is solid on where storage lives — resource type by Region, across accounts — and that is the part of CM-12 most often undocumented. The tag query is only as true as your tagging: GetResources by design never returns untagged resources, so an unclassified bucket is absent from the answer rather than flagged, which is precisely backwards for an inventory control; run it beside the aggregate count and treat the difference as your unclassified population. Macie is the only machine-derived opinion about information type, and it is a sample rather than a census — automated sensitive data discovery continually selects representative objects from your buckets and scores each bucket from those, so a MONITORED bucket with a low score means ‘nothing sensitive in what was sampled’, never ‘no sensitive data here’. The unclassifiable object count is the population Macie could not read at all because of storage class or file format, and per-file size quotas mean a large archive can be skipped entirely, so read coverage before reading scores. Macie also only looks at S3: nothing above inspects an RDS table, an EFS volume, a DynamoDB item or a Parameter Store value, and the Region field tells you where a bucket is, which is the CM-12 question, not what is in it. What no command produces is CM-12 itself — the documented location of each information type, the users authorized to access it and the purpose it is held for. That is a record you write and then check against this telemetry, not one you derive from it.

## References

- {"title":"AWS CLI: configservice select-aggregate-resource-config (aggregator queries, 500 vs 25 default page size)","url":"https://docs.aws.amazon.com/cli/latest/reference/configservice/select-aggregate-resource-config.html"}
- {"title":"AWS CLI: resourcegroupstaggingapi get-resources (per-Region; does not return untagged resources)","url":"https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html"}
- {"title":"Amazon Macie: performing automated sensitive data discovery (sampling, sensitive data findings and discovery results)","url":"https://docs.aws.amazon.com/macie/latest/user/discovery-asdd.html"}
- {"title":"AWS CLI: macie2 get-automated-discovery-configuration (status, classificationScopeId, sensitivityInspectionTemplateId)","url":"https://docs.aws.amazon.com/cli/latest/reference/macie2/get-automated-discovery-configuration.html"}
- {"title":"AWS CLI: macie2 describe-buckets (sensitivityScore, automatedDiscoveryMonitoringStatus, unclassifiableObjectCount)","url":"https://docs.aws.amazon.com/cli/latest/reference/macie2/describe-buckets.html"}
- {"title":"Amazon Macie endpoints and quotas (no AWS GovCloud (US) endpoint listed; per-file size quotas)","url":"https://docs.aws.amazon.com/general/latest/gr/macie.html"}
- {"title":"AWS Config managed rule: macie-status-check (excluded from AWS GovCloud (US-East) and (US-West))","url":"https://docs.aws.amazon.com/config/latest/developerguide/macie-status-check.html"}
- {"title":"AWS Resource Groups and Tagging endpoints and quotas (tagging.us-gov-east-1, tagging.us-gov-west-1)","url":"https://docs.aws.amazon.com/general/latest/gr/arg.html"}
- {"title":"AWS Config in AWS GovCloud (US) — differences (no recording of third-party or custom resource types)","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-config.html"}