Question

A financial services company runs 120 accounts under AWS Control Tower. The security team must audit whether every account continuously enforces a set of ~40 detective controls (Config rules) mapped to their internal compliance framework. Finance has flagged that AWS Config recording costs have grown rapidly because every account records ALL resource types, including many that are irrelevant to the compliance framework. The team wants to reduce Config cost while still meeting the audit requirement and managing controls centrally across the organization. Which approach best balances centralized governance, audit coverage, and cost?

Accepted Answer

Deploy the 40 Config rules as a conformance pack via Control Tower/Config across the organization, and adjust the Config recorder in each account to record only the specific resource types evaluated by those rules.

Answer

Turn off AWS Config in accounts that show high cost and rely on a monthly manual review using AWS Config snapshots exported to S3 for the audit evidence.

Answer

Replace AWS Config entirely with a set of scheduled Lambda functions in each account that describe resources and write compliance results to a central DynamoDB table.

Answer

Enable Security Hub CIS and PCI standards in all accounts instead of Config rules, since Security Hub does not incur Config recording charges.