Question

A security engineer at a company with 40 AWS accounts under AWS Organizations needs a single, read-only dashboard that shows the compliance status of all AWS Config rules across every account and every Region. The solution must automatically include new accounts as they join the organization and must not require the engineer to log in to each account individually. What is the most operationally efficient way to achieve this?

Accepted Answer

Create an organization aggregator in AWS Config from the delegated administrator account, configured to aggregate data from all accounts in the organization and all Regions.

Answer

Enable AWS Config in each account and configure a CloudWatch cross-account dashboard that pulls the ConfigRuleComplianceStatus metric from every account.

Answer

Create an individual account aggregator in the management account and manually add each of the 40 account IDs as authorized source accounts.

Answer

Export AWS Config compliance snapshots from every account to a central S3 bucket and query the combined results with Amazon Athena.