Question

A CloudOps engineer manages security for an organization with 40 accounts in AWS Organizations. Leadership requires that AWS Security Hub be enabled across all existing and future member accounts, with the AWS Foundational Security Best Practices standard consistently applied, and findings aggregated in a single security account. The engineer wants to minimize per-account manual configuration and ensure new accounts are onboarded automatically. Which approach meets these requirements with the least ongoing effort?

Accepted Answer

Designate the security account as the Security Hub delegated administrator, then use central configuration to create a configuration policy that enables Security Hub and the FSBP standard, associating it with the organization root.

Answer

Enable Security Hub manually in each member account, subscribe each account to the FSBP standard, and configure cross-region aggregation in every account.

Answer

Create a CloudFormation StackSet that runs a Lambda function in each account to call the Security Hub API and enable standards on a scheduled basis.

Answer

Enable Security Hub only in the management account and use an EventBridge rule to forward all member account findings to it.