A media organisation with 90 accounts in AWS Organizations wants one account, rather than the management account, to operate its security tooling and view findings from every member account. The security team needs Amazon GuardDuty and AWS Security Hub findings aggregated organisation-wide, automatic enrolment of new accounts, and a design that keeps the management account out of day-to-day security operations to limit its blast radius. Which approach BEST achieves centralised security operations across the organisation?
- AOperate GuardDuty and Security Hub from the management account directly, inviting each member account individually and re-running the invitation process by hand whenever a new account is created anywhere in the organisation.
- BConfigure an AWS Config organisation aggregator in the security account and rely on its conformance pack compliance status to surface the threat findings the security team needs from every member account.
- CDesignate the dedicated security account as the delegated administrator for GuardDuty and Security Hub in AWS Organizations, then enable automatic enablement so new member accounts are onboarded as they join. Correct
- DReplicate each member account's GuardDuty and Security Hub findings into a central S3 bucket with EventBridge rules and have the security team query the consolidated objects with Amazon Athena.
Why A is wrong: Running security tooling from the management account widens its blast radius, and manual per-account invitations do not auto-enrol new accounts, so coverage drifts as the organisation grows.
Why B is wrong: A Config aggregator centralises configuration and rule compliance, but it does not collect GuardDuty threat detections or Security Hub findings, so the security team would lack the threat data the requirement names.
Why C is correct: Delegated administration moves GuardDuty and Security Hub operations into the dedicated security account and away from the management account, and turning on automatic enablement onboards every current and future member account so findings aggregate organisation-wide.
Why D is wrong: Per-account EventBridge export to S3 can collect findings, but it is custom plumbing that each account must keep configured and gives no native aggregated console, duplicating capability the delegated administrator already provides.