Question

A financial services company runs 40 AWS accounts under AWS Organizations. The security governance team must continuously evaluate resource configurations against a custom internal baseline of 25 rules (some with auto-remediation) across all accounts, and they want a single pass/fail compliance score per account that can be centrally deployed and updated without touching each account individually. They already use Security Hub for aggregating GuardDuty and Inspector findings but do not want to pay for additional Security Hub security-standard control checks. Which approach BEST meets the configuration-baseline requirement while minimizing added Security Hub costs?

Accepted Answer

Deploy an AWS Config conformance pack containing the 25 custom rules and remediation actions from the delegated administrator account to the entire organization.

Answer

Enable the AWS Foundational Security Best Practices standard in Security Hub across the organization and rely on its controls for the internal baseline.

Answer

Create the 25 rules as individual AWS Config managed and custom rules manually in each of the 40 accounts and track compliance with a spreadsheet.

Answer

Author the baseline as a set of preventive SCPs at the organization root so that noncompliant configurations can never be created.