Question

A financial services company operates 40 AWS accounts under AWS Organizations. The security governance team must continuously detect and report on security groups that allow unrestricted inbound access (0.0.0.0/0) to ports other than 80 and 443 across all accounts and Regions, and produce a single compliance dashboard for auditors. Which approach best meets these governance requirements with the least operational overhead?

Accepted Answer

Deploy an AWS Config conformance pack containing the restricted-common-ports and vpc-sg-open-only-to-authorized-ports managed rules using an organization-level deployment via the delegated administrator account, aggregating results with a Config aggregator.

Answer

Enable VPC Flow Logs in every account, stream them to a centralized S3 bucket, and run scheduled Athena queries to identify traffic arriving on unauthorized ports from any source.

Answer

Write a Lambda function in each account triggered by EventBridge on a daily schedule that calls DescribeSecurityGroups and publishes non-compliant findings to a central SNS topic.

Answer

Configure AWS Network Firewall in a centralized inspection VPC with stateful rules that block inbound traffic to ports other than 80 and 443, and review the firewall logs for compliance reporting.