Question

A company operates 45 AWS accounts managed under AWS Organizations. The security team wants a centralized way to view and prioritize GuardDuty threat findings, Inspector vulnerability findings, and misconfiguration findings from managed compliance standards across all accounts in one console. They also want new accounts to be automatically enrolled without manual configuration. Which approach best meets these requirements with the least ongoing operational effort?

Accepted Answer

Enable AWS Security Hub with the Organizations integration, designate a delegated administrator account, turn on auto-enable for new accounts and standards, and enable Security Hub integrations with GuardDuty and Inspector.

Answer

Enable Amazon Detective in a central account and invite all member accounts to send their GuardDuty and Inspector findings for aggregation and prioritization.

Answer

Configure Amazon EventBridge rules in each account to forward all GuardDuty and Inspector findings to an S3 bucket in a central account, then use Amazon Athena to query and prioritize them.

Answer

Enable GuardDuty with a delegated administrator and rely on the GuardDuty console to aggregate Inspector findings and compliance standard results across all accounts.