Question

A financial services company runs a multi-account AWS Organization with over 80 member accounts. The central security team currently operates entirely from the management (payer) account, where they manage GuardDuty, Security Hub, and IAM Access Analyzer findings for the whole organization. During an audit, the company is told that using the management account for daily operational tasks violates AWS security best practices and increases blast radius. The security team must retain organization-wide visibility and continue enrolling new accounts automatically, while minimizing the privileged actions performed from the management account. What should the solutions architect recommend?

Accepted Answer

Register a dedicated security member account as the delegated administrator for GuardDuty, Security Hub, and IAM Access Analyzer, and have the security team operate those services from that account.

Answer

Create a cross-account IAM role in every member account that the security team assumes from the management account to review findings individually.

Answer

Apply an SCP that denies all actions in the management account except security service APIs, so the team can keep working there safely.

Answer

Move GuardDuty, Security Hub, and IAM Access Analyzer configuration into AWS Control Tower and manage findings through the Control Tower dashboard in the management account.