Question

A large enterprise runs 200 accounts in AWS Organizations. The central security team operates entirely from a dedicated Security account (not the management account). Company policy mandates that the management account should be used only for billing and organization structure changes, and no security operators should have credentials in it. The team needs to administer GuardDuty, Security Hub, and IAM Access Analyzer across the whole organization from the Security account. What is the MOST appropriate way to enable this while adhering to the policy?

Accepted Answer

Register the Security account as a delegated administrator for GuardDuty, Security Hub, and IAM Access Analyzer from the management account, then perform all ongoing administration from the Security account.

Answer

Create a cross-account IAM role in the management account that security operators assume whenever they need to configure the security services organization-wide.

Answer

Move all security service configuration to an SCP attached to the root so the services are automatically enabled and managed through policy, avoiding any account-level administration.

Answer

Enable each security service independently in all 200 member accounts using CloudFormation StackSets, without designating any administrator account.