Question

A security team operates a centralized audit account. They want all AWS Config compliance-change events and GuardDuty findings emitted from 40 member accounts to be routed to a single custom event bus in the audit account, where a Lambda function processes them. The solution must be event-driven, avoid polling, and follow least-privilege principles. What is the MOST appropriate way to configure this?

Accepted Answer

In each member account, create an EventBridge rule on the default event bus that matches the relevant event patterns and sets the audit account's custom event bus as the target; add a resource-based policy on the audit bus allowing PutEvents from the member account org, and create a rule on the audit bus that targets the Lambda function.

Answer

Configure the Lambda function in the audit account to periodically call GetFindings and DescribeConfigRules across all 40 accounts using assumed roles, storing results in DynamoDB.

Answer

Enable CloudWatch cross-account observability sharing so member account events stream into the audit account, then create a metric filter that triggers the Lambda function.

Answer

Create an SNS topic in each member account subscribed to Config and GuardDuty, and have the audit account Lambda function poll each SNS topic's dead-letter queue for new messages.