Question

A CloudOps engineer manages compliance for an organization with 40 AWS accounts across 3 regions using AWS Organizations. The security team wants a single, centralized dashboard showing the compliance status of AWS Config rules across all member accounts and regions without logging into each account individually. AWS Config is already enabled in every account and region. What is the MOST operationally efficient way to provide this centralized view?

Accepted Answer

Create an AWS Config aggregator in a designated account that is authorized to aggregate data from the entire organization, then view aggregated compliance in that account's Config console.

Answer

Configure each member account to publish Config snapshots to a central S3 bucket and build an Amazon QuickSight dashboard that queries the aggregated data with Athena.

Answer

Use AWS Config conformance packs deployed individually in each account and manually compile the compliance reports into a shared spreadsheet weekly.

Answer

Enable CloudTrail organization trails and create CloudWatch dashboards that count Config rule evaluation API calls across accounts.