Question

A DevOps team manages 40 AWS accounts under AWS Organizations. The security team needs a single, read-only view of AWS Config rule compliance status across all member accounts and multiple regions, updated automatically as new accounts join the organization. They want to minimize ongoing operational overhead and avoid deploying custom scripts to fetch data from each account. Which approach best meets these requirements?

Accepted Answer

Create an organization-wide AWS Config aggregator in a delegated administrator account with an organization data source covering all enabled regions.

Answer

Deploy a Lambda function in each account on a schedule that calls the Config API and writes compliance data to a central S3 bucket for consolidation.

Answer

Create an individual account-based Config aggregator in the management account and manually add each of the 40 accounts and their regions as authorized sources.

Answer

Enable AWS Config in each account and use CloudWatch cross-account dashboards to visualize the compliance metrics centrally.