A central security team manages an AWS Organizations setup with dozens of member accounts. Each account already has Amazon GuardDuty, Amazon Inspector, and several AWS Config rules producing findings independently. The team wants a single place that automatically ingests findings from all of these services in a normalised format, deduplicates them, runs compliance checks against the AWS Foundational Security Best Practices standard, and provides one cross-account dashboard. Which approach meets this requirement with the least custom integration work?
- AEnable AWS Security Hub with a delegated administrator account and organisation auto-enable, so it ingests findings in the normalised format, deduplicates them, runs the Foundational Security Best Practices standard, and shows a cross-account dashboard. Correct
- BBuild an AWS Lambda function in each account that reads GuardDuty, Inspector, and Config findings, converts them to a shared schema, and writes them to a central Amazon DynamoDB table that a custom dashboard then queries for cross-account review.
- CConfigure Amazon Detective as the organisation aggregator so that it normalises GuardDuty, Inspector, and Config findings across all member accounts and evaluates them against the AWS Foundational Security Best Practices standard in one dashboard.
- DForward every finding to a central Amazon S3 bucket through Amazon EventBridge rules in each account, then use Amazon Athena queries to deduplicate the records and a separate tool to score them against security best practices.
Why A is correct: Security Hub natively consumes GuardDuty, Inspector, and Config findings in the AWS Security Finding Format, deduplicates them, runs managed compliance standards, and with a delegated administrator gives one organisation-wide dashboard out of the box.
Why B is wrong: A per-account Lambda and DynamoDB table can centralise findings, but it is heavy custom code that you must maintain and it provides no built-in standard compliance scoring, which is the opposite of the least-effort requirement.
Why C is wrong: Detective is tempting as a cross-account security tool, but it focuses on investigation graphs from log sources and does not normalise multi-service findings or run security-standard compliance checks, so it misses the stated needs.
Why D is wrong: Routing findings to S3 and querying with Athena can centralise data, but it requires you to build deduplication and standard scoring yourself, which is far more integration work than a service that does this natively.