Question

A security engineer wants a managed way to continuously detect resource misconfigurations across an AWS account, such as public S3 buckets, unrestricted security groups, and IAM users without MFA. The engineer wants automated checks that map to well-known security best practices and produce findings that indicate PASSED or FAILED status per control, without having to author individual detection rules. Which approach meets these requirements with the least operational effort?

Accepted Answer

Enable the AWS Foundational Security Best Practices standard in AWS Security Hub, which runs automated configuration checks and generates control-level findings.

Answer

Enable Amazon GuardDuty and rely on its threat-detection findings to identify the misconfigured resources.

Answer

Enable Amazon Inspector to scan the account for the misconfigurations and report control pass/fail status.

Answer

Write custom AWS Config rules for each misconfiguration type and send the evaluation results to Amazon Detective.