Question

A security team manages a multi-account AWS Organization with workloads deployed across four Regions. They have enabled Amazon GuardDuty in all accounts and Regions via the organization delegated administrator. The compliance team now requires that all GuardDuty findings be automatically collected into a single account and Region for centralized correlation, long-term retention in S3, and cross-referencing during investigations, without writing custom polling code. Which approach best meets these requirements?

Accepted Answer

Configure GuardDuty finding export to a centralized S3 bucket, and in each Region create an EventBridge rule that forwards GuardDuty findings to a custom event bus in the central account and Region.

Answer

Enable a single GuardDuty detector only in the central Region and rely on VPC peering to route findings from other Regions into it.

Answer

Use AWS Config aggregators to pull GuardDuty findings from all accounts and Regions into the central account for retention in S3.

Answer

Write a Lambda function in each Region that periodically calls the GuardDuty ListFindings API and copies results to the central S3 bucket every five minutes.