Question

A security engineer manages an AWS Organization with 40 member accounts operating in five AWS Regions. Leadership wants a single pane of glass where all Security Hub findings from every account and Region are viewable and prioritized in one place, and they want new standards and controls to be enabled consistently as accounts and Regions are added, without manual per-account configuration. Which approach meets these requirements with the least ongoing operational effort?

Accepted Answer

Designate a delegated administrator account, enable Security Hub central configuration, create a configuration policy that enables standards and controls, and set up a linked (aggregation) Region to consolidate findings from all Regions.

Answer

Enable Security Hub individually in each account and Region, then use EventBridge rules in every Region to forward all findings to an S3 bucket in a central account for review.

Answer

Enable Security Hub in the management account only and rely on AWS Config aggregators to pull findings from member accounts into a single dashboard.

Answer

Use a cross-Region replication rule on each Security Hub finding stream and write a Lambda function that re-imports findings into the delegated administrator's home Region.