Finance staff manage consolidated billing in the payer account while the SOC runs Security Hub and GuardDuty admin tooling elsewhere. How should those roles be separated in the org design?
Select an answer to reveal the explanation.
Short Explanation
The city treasurer's office is not the police evidence room — different locks, different staff. Keep the payer account for consolidated billing and a separate security account for Hub and GuardDuty admin.
Full Explanation
Well-architected multi-account models separate concerns: the management/payer account handles Organizations and billing, while a dedicated security account owns delegated admin for Security Hub, GuardDuty, and related tooling. Combining billing and security admin in one place concentrates privilege. Broad developer admin on the payer account and ad-hoc personal GuardDuty setups undermine governance and least privilege.