Question

A company manages 60 accounts in AWS Organizations across three Regions. The security team wants a single place to enable Security Hub, turn on the AWS Foundational Security Best Practices standard, and automatically apply the same enabled/disabled control settings to all existing and future member accounts in all target Regions — without writing custom scripts to update each account individually. Which approach meets these requirements with the least ongoing operational overhead?

Accepted Answer

Designate a delegated administrator account and use Security Hub central configuration to create a configuration policy that enables the standard and control settings, then associate the policy with the organization root.

Answer

Enable Security Hub in each account manually and use a Lambda function triggered by CloudTrail to reapply control settings whenever a new account joins the organization.

Answer

Deploy a CloudFormation StackSet that enables Security Hub and the standard in every account and Region, and re-run the StackSet whenever control settings change.

Answer

Turn on Security Hub auto-enable for new accounts in the delegated administrator, and rely on each member account owner to configure the standard and controls locally.