Question

A DevOps engineer at a financial services company must produce an on-demand report that lists all EC2 instances across 40 member accounts and 3 regions that do NOT have detailed monitoring enabled. Auditors request this report ad hoc and expect it within minutes, without deploying additional infrastructure. AWS Config is already enabled organization-wide with a delegated administrator account hosting an aggregator. What is the MOST efficient way to generate this cross-account, cross-region inventory report?

Accepted Answer

Use AWS Config advanced queries (SQL-based) against the configuration aggregator in the delegated administrator account to select resources of type AWS::EC2::Instance where detailed monitoring is disabled.

Answer

Deploy a Lambda function in every account and region that calls the EC2 DescribeInstances API, aggregate results in an S3 bucket, and query them with Athena.

Answer

Create a custom AWS Config rule with a Lambda evaluation function and review the compliance timeline in each member account individually.

Answer

Enable AWS Systems Manager Inventory across all accounts and use Resource Data Sync to consolidate instance metadata into an S3 bucket for querying.