Question

A security governance team manages 60 accounts through AWS Organizations with Control Tower. They must produce a single dashboard that scores each account against the CIS AWS Foundations Benchmark, automatically re-scores when new accounts are enrolled, and enables cross-account remediation of common misconfigurations without deploying and maintaining rule definitions in every account individually. Which approach best meets these requirements with the least ongoing operational overhead?

Accepted Answer

Enable AWS Security Hub with central configuration from the delegated administrator account, apply the CIS AWS Foundations Benchmark standard organization-wide, and configure automated response and remediation via EventBridge rules.

Answer

Deploy identical AWS Config rules manually in every member account and build a custom Lambda function that aggregates compliance data into a shared S3 bucket for reporting.

Answer

Create an AWS Config aggregator in the audit account and rely on it to automatically enforce the CIS benchmark and remediate findings across all member accounts.

Answer

Use Service Control Policies to block all API calls that would create non-compliant resources, eliminating the need for benchmark scoring.