Question

A company runs 40 accounts under AWS Organizations across three Regions. The security team wants a single pane of glass for all Security Hub findings, needs new accounts enrolled automatically without manual per-account configuration, and must ensure findings from every Region are visible in one place. They also want to enable the AWS Foundational Security Best Practices standard everywhere. Which approach meets these requirements with the least ongoing operational effort?

Accepted Answer

Designate a delegated administrator account for Security Hub in the organization, enable central configuration with a configuration policy that turns on the FSBP standard, and set up a Region as the aggregation Region to link findings from all other Regions.

Answer

Enable Security Hub manually in each account and Region, then create an EventBridge rule in every account that forwards findings to an S3 bucket in the security account for consolidated querying with Athena.

Answer

Use a StackSet to deploy Security Hub configuration to all accounts, and configure each member account to send findings to the management account using cross-account IAM roles invoked by a scheduled Lambda function.

Answer

Designate a delegated administrator account, enable Security Hub only in the delegated administrator account, and rely on GuardDuty to relay member account findings into the administrator's Security Hub console.