# Macie + Detective Paired Pipeline (July 2026)

Macie pricing dimensions: bucket/security monitoring + automated discovery object monitoring + per-GB analysis (jobs / automated). **30-day free trial** for bucket monitoring (jobs still bill). Scope prefixes/accounts.

## Pipeline

1. Macie automated discovery → Security Hub
2. Macie policy findings (public/unencrypted + sensitive) → EventBridge containment
3. GuardDuty → Security Hub; elevate when bucket is Macie-sensitive
4. Open Detective from finding → 30-day entity graph
5. Document timeline; Object Lock evidence export

## Enable order

- [ ] Org delegated admin for Macie + Detective
- [ ] CMK key policy: `kms:Decrypt` for Macie on SSE-KMS CMKs
- [ ] Prod/shared accounts first; skip sandboxes for Detective
- [ ] Separate EventBridge routes: posture alerts vs discovery inventory

## Counter-case

Macie is S3-centric — not a full multi-cloud DSPM for RDS/DynamoDB columns.