Question

A company runs 40 AWS accounts under AWS Organizations. The security team wants every existing and future member account to have AWS Security Hub enabled with the AWS Foundational Security Best Practices standard turned on, and to automatically receive findings from GuardDuty and Config as they are provisioned. The team wants the least ongoing operational effort and no manual steps when new accounts join. Which approach meets these requirements?

Accepted Answer

Designate a delegated administrator account for Security Hub in Organizations, enable auto-enablement for new accounts along with the Foundational Security Best Practices standard, and configure Security Hub as the aggregation point so it automatically ingests GuardDuty and Config findings.

Answer

Deploy a CloudFormation StackSet with automatic deployment to the organization that runs a Lambda function in each account to call the Security Hub EnableSecurityHub API on a scheduled EventBridge rule every hour.

Answer

Enable Security Hub manually in the management account and use a Config conformance pack to enforce that member accounts have Security Hub enabled, remediating noncompliant accounts with SSM Automation.

Answer

Create an IAM role in each member account and have a central script assume the role nightly to enable Security Hub and subscribe to the Foundational Security Best Practices standard for any account missing it.