Question

A financial services company runs 40 accounts under AWS Organizations. The security team wants a single account to receive and query AWS Config data (resource configuration items and compliance state) from all member accounts across three Regions, without individually logging into each account. They also require that the aggregation view survives new accounts being added by Control Tower Account Factory without manual reconfiguration. Which approach BEST meets these requirements with the least ongoing operational overhead?

Accepted Answer

Create an AWS Config aggregator in a delegated administrator account that is authorized for the entire organization, so it automatically includes current and future member accounts across the specified Regions.

Answer

In each member account, configure the Config delivery channel to write to a central S3 bucket, then use Athena in the security account to query the exported configuration snapshots.

Answer

Set up an AWS Config aggregator in the security account and manually add each member account and Region as an authorized source, updating it whenever Account Factory provisions a new account.

Answer

Use AWS Resource Access Manager to share each member account's Config recorder with the security account, allowing cross-account queries of compliance state.