Question

A financial services company runs AWS Control Tower with a multi-account landing zone. The central security team wants to run advanced, custom Security Hub and GuardDuty administration across all member accounts, but the company's compliance policy forbids using the Organizations management account for any day-to-day operational security work. The team needs to grant a dedicated Audit account the ability to centrally manage these security services organization-wide. What is the recommended approach to meet this requirement while following AWS best practices?

Accepted Answer

Register the Audit account as a delegated administrator for Security Hub and GuardDuty from the Organizations management account, then perform all central security operations from the Audit account.

Answer

Create an IAM role in the management account with full administrative permissions and have the security team assume it whenever they need to manage security services.

Answer

Attach an SCP to the Audit account's OU that grants Security Hub and GuardDuty administrative permissions to the security team.

Answer

Move all security service administration into the Control Tower Audit account by enabling AWS Config aggregation only, since delegated administration is not supported with Control Tower.