Question

A security governance team manages an AWS Organization with 150 accounts. External auditors need read-only access to view the aggregated compliance status of all AWS Config rules across every account and Region, from a single location, for a quarterly audit. The team wants to minimize ongoing operational effort and avoid granting auditors access to each individual member account. Which approach best meets these requirements?

Accepted Answer

Set up an AWS Config aggregator in a delegated administrator account that collects data from the entire organization, then grant auditors read-only IAM access to the aggregator's compliance dashboard in that account.

Answer

Enable AWS Config in each account, export the configuration snapshots to a central S3 bucket, and have auditors query the raw JSON files using Athena.

Answer

Create a cross-account IAM role in every member account and provide the auditors with instructions to assume each role and review Config compliance individually.

Answer

Use AWS Security Hub in each account and email the auditors weekly CSV exports of the findings summaries.