Question

A company has 40 AWS accounts managed in AWS Organizations and is adding roughly 5 new accounts per quarter. The security team wants Amazon GuardDuty findings from all accounts—including any account created in the future—to be centrally visible and managed from a single dedicated security account, with minimal ongoing manual effort. Which approach meets these requirements?

Accepted Answer

Designate the security account as the GuardDuty delegated administrator from the Organizations management account, then enable auto-enable for all existing accounts and turn on auto-enable for new organization member accounts.

Answer

Enable GuardDuty individually in each member account and configure a cross-account IAM role in the security account to periodically pull findings from every account via API on a scheduled Lambda function.

Answer

Enable GuardDuty in the Organizations management account and use an EventBridge rule to forward findings to the security account, adding new accounts to the rule as they are created.

Answer

Send GuardDuty invitations from the security account to each member account and re-run an onboarding script manually whenever a new account joins the organization.