An organisation runs workloads in several accounts across two Regions and wants one place to view aggregated security findings from GuardDuty, Inspector, and Macie, with automated checks against the AWS Foundational Security Best Practices standard. Findings from every account and both Regions must roll up to a single account. Which approach delivers this consolidated security posture view?
- AEnable Amazon GuardDuty as the aggregation point, since it collects findings from Inspector and Macie and runs the Foundational Security Best Practices controls across all accounts.
- BConfigure AWS Config aggregators in the home account to collect findings from the security services and evaluate them against the Foundational Security Best Practices standard.
- CSet up an Amazon EventBridge rule in each Region that forwards GuardDuty, Inspector, and Macie events to a single S3 bucket and query them with Amazon Athena.
- DEnable AWS Security Hub with a delegated administrator, turn on the Foundational Security Best Practices standard, and configure cross-Region aggregation to a home Region in that account. Correct
Why A is wrong: GuardDuty is a finding source for threat detection and does not aggregate Inspector and Macie findings or run security standard controls, so it cannot serve as the consolidated posture view.
Why B is wrong: Config aggregators consolidate configuration and rule compliance data rather than service findings, and Config does not run the named security standard, so it does not meet the requirement.
Why C is wrong: Routing raw events to a bucket gives no managed standard checks and no built-in console view, so the team would build and maintain the aggregation and scoring themselves.
Why D is correct: Security Hub ingests findings from GuardDuty, Inspector, and Macie, runs the named standard's automated checks, and its delegated administrator with cross-Region aggregation rolls everything into one account and Region as required.