Question

A security team manages a centralized audit account and needs to continuously verify that no VPC across 40 member accounts (in an AWS Organization) has an internet gateway attached to subnets tagged 'PCI-Restricted'. The team wants a scalable, near-real-time governance solution that produces findings in the audit account without deploying custom Lambda in each member account. Which approach best meets this requirement?

Accepted Answer

Deploy an AWS Config organization custom rule (using a Config-managed Lambda in the delegated administrator account) that evaluates route table associations for PCI-Restricted subnets, and aggregate results in the audit account via an organization aggregator.

Answer

Enable VPC Flow Logs in every member account, stream them to a centralized S3 bucket, and run scheduled Athena queries to detect traffic to 0.0.0.0/0 through an internet gateway.

Answer

Create an IAM role in each member account trusted by the audit account and run a scheduled script that calls DescribeRouteTables in every account to check for igw- routes.

Answer

Use AWS Network Firewall in a centralized inspection VPC with a stateful rule that drops traffic from PCI-Restricted subnets destined to internet gateways, and review the alert logs.