Question

A security governance team manages 120 accounts under AWS Control Tower. Leadership requires a monthly compliance report showing which accounts have deviated from the mandatory guardrails baseline (such as disallowed public S3 access and CloudTrail configuration changes). The team wants a single dashboard that continuously evaluates resource configurations across all accounts and highlights non-compliant resources over time, without writing custom aggregation code. Which approach best meets this requirement at scale?

Accepted Answer

Enable detective (strongly recommended) guardrails in Control Tower, which use AWS Config rules across the landing zone, and review the aggregated compliance status in the Control Tower dashboard and the Config aggregator.

Answer

Attach preventive SCPs to the organization root that deny the non-compliant actions, then rely on CloudTrail logs to produce the monthly deviation report.

Answer

Deploy a custom Lambda function in each account that scans resources on a schedule and writes findings to a central S3 bucket for reporting.

Answer

Enable GuardDuty across all accounts and use the findings dashboard to identify configuration deviations from the guardrail baseline.