Question

A company operates workloads in multiple AWS accounts that are part of an AWS Organization. The security team wants all Amazon GuardDuty findings emitted by member accounts to be delivered to a single central security account, where a Lambda function will process them for automated remediation. Findings are published as events in each member account's default event bus. What is the MOST appropriate way to aggregate these events into the central account?

Accepted Answer

In each member account, create an EventBridge rule on the default event bus that matches GuardDuty findings and sets the target to a custom event bus in the central security account, then create a rule on that central bus targeting the Lambda function.

Answer

Configure a CloudWatch Logs subscription filter in each member account that forwards GuardDuty findings to a Kinesis Data Stream in the central account, then trigger the Lambda function from the stream.

Answer

Enable cross-account CloudWatch observability so the central account can read the member accounts' metrics, then create a metric filter that invokes the Lambda function.

Answer

Create an SNS topic in each member account subscribed by the Lambda function in the central account, and configure GuardDuty to publish findings directly to SNS.