Add AWS check: Macie PHI discovery status

[aanishs]

What

Add an AWS check for Amazon Macie PHI discovery status.

v2 Architecture

1. Add to frameworks/checks-registry.ts:

{ id: 'aws-macie-enabled', category: 'sensitive_data', description: 'Amazon Macie enabled for automated PHI/PII discovery', type: 'cloud_cli', provider: 'aws', command: 'aws macie2 get-macie-session --output json', severity_default: 'MEDIUM' }

2. Add to nist/tool-bindings.json under control SI-12 (Information Management):

"SI-12": { "emdash": [..., "aws-macie-enabled"], ... }

3. Run bun test to verify.

Why

Maps to NIST SI-12. Macie automates PHI discovery in S3 — the AWS-native way to know where sensitive data exists.

[aanishs]

Update (v3.2): The v2 instructions in this issue still work. The architecture now has 60+ checks in checks-registry.ts, tool-bindings v3.0 (includes Trivy AVD IDs and CIS Benchmark refs), and 8 Rego policy files. When adding a check, also consider which CIS Controls safeguard it maps to.