Question

A security engineer manages an organization with 60 accounts spread across 3 AWS Regions. Each account already has AWS Config enabled recording resources, and a standardized set of Config rules is deployed to every account. The engineer's CISO wants a single, centralized, read-only view of the compliance status of all Config rules across every account and Region, without having to log into each account individually. The solution must require minimal ongoing maintenance as new accounts join the organization. What should the engineer implement?

Accepted Answer

Create an organization aggregator in a designated central account and authorize it for the entire organization, so it automatically collects Config configuration and compliance data from all current and future accounts and Regions.

Answer

Enable an AWS Config conformance pack in each member account and configure it to publish compliance results to a central S3 bucket for reporting.

Answer

Deploy an EventBridge rule in each account that forwards Config compliance change events to a central account, then build a dashboard from the collected events.

Answer

Create an individual account-level Config aggregator in the central account and manually add each of the 60 account IDs and their Regions as authorized sources.