Question

A CloudOps engineer manages a security posture for an organization with workloads deployed across five AWS Regions in multiple member accounts. Compliance auditors require a single consolidated view of all Security Hub findings and control statuses across every Region and account, and they want new member accounts to be automatically enrolled. Which combination of actions BEST meets these requirements with the least ongoing operational effort?

Accepted Answer

Designate a delegated administrator account for Security Hub through AWS Organizations, enable central configuration with auto-enrollment, and configure a cross-Region aggregation Region to consolidate findings.

Answer

Enable Security Hub in each account and Region individually, then build a custom Lambda function to poll each Security Hub endpoint and push findings into a central S3 bucket for auditors.

Answer

Use AWS Config aggregators in a single account to collect Security Hub findings from all Regions and accounts into one dashboard.

Answer

Enable Security Hub only in the management account's home Region and rely on CloudTrail organization trails to capture findings from all other Regions.