Question

A financial services company operates 40 AWS accounts under AWS Organizations, spread across three Regions. The security governance team must continuously evaluate whether any security group in any account permits unrestricted inbound SSH (0.0.0.0/0 on port 22), and they need a single consolidated view of all non-compliant resources across the entire organization without logging into each account. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Deploy AWS Config with the restricted-ssh managed rule in every account and Region using a CloudFormation StackSet, then create an organization-wide AWS Config aggregator in a delegated administrator account to view aggregated compliance results.

Answer

Enable VPC Flow Logs in every account, stream them to a centralized S3 bucket, and run scheduled Athena queries to detect SSH traffic sourced from 0.0.0.0/0.

Answer

Create a single AWS Config rule in the management account and rely on cross-account IAM roles so the rule evaluates security groups in all member accounts and Regions.

Answer

Use AWS Security Hub in one account with the CIS benchmark enabled and manually export findings from each member account into a spreadsheet weekly.