A financial services firm runs 60 AWS accounts under AWS Organizations with new accounts added monthly. Auditors require continuous checks for public S3 buckets, unencrypted volumes, and open security groups, with central findings and automatic evaluation in every Region. Which governance design provides automated multi-account compliance monitoring?
Select an answer to reveal the explanation.
Short Explanation
You'll sleep better when your 60 accounts report to one place instead of chasing alerts everywhere. With a delegated Security Hub admin plus a Config aggregator, conformance packs act like smoke alarms in every room, checking buckets, volumes, and groups in all Regions automatically.
Full Explanation
A delegated Security Hub administrator with an AWS Config aggregator creates centralized CSPM visibility across the organization, while AWS Config managed rules packaged as conformance packs provide versioned, continuous evaluation of controls like S3 public access, EBS encryption, and restricted security groups in every account and Region. New accounts inherit the baseline through Organizations stack deployment, satisfying auditor demands for consistency and history. GuardDuty with CloudTrail Insights focuses on threat detection and anomaly analysis rather than configuration compliance evaluation, and sharing via Resource Access Manager does not aggregate posture. Macie targets sensitive data discovery in S3 and Athena querying is detective and manual, lacking continuous rule evaluation and central compliance scoring. SCPs prevent future actions but do not detect existing drift, and Trusted Advisor checks plus email reports are not continuous, centralized compliance evidence. Exam caveat: Security Hub aggregates findings while Config evaluates configuration state; questions asking for monitoring need both. Practical check: verify aggregator covers all Regions and conformance pack compliance in the delegated admin account.