Question

A security engineer must continuously evaluate all AWS accounts in an organization against a recognized configuration baseline (such as password policy, root account MFA, and disabled public S3 access) and receive an ongoing compliance score with pass/fail status for each control. The solution should require minimal custom development and automatically re-evaluate resources as configuration changes occur. Which approach best meets these requirements?

Accepted Answer

Enable AWS Security Hub and turn on the CIS AWS Foundations Benchmark and AWS Foundational Security Best Practices standards, which run automated checks backed by AWS Config and produce a compliance score.

Answer

Enable Amazon GuardDuty in all accounts and rely on its threat findings to indicate configuration compliance status.

Answer

Deploy Amazon Inspector across all accounts to scan for CIS benchmark misconfigurations and generate a compliance score per control.

Answer

Write custom AWS Config rules for each CIS control individually and build a Lambda function to aggregate the results into a manual scoring dashboard.