CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Understanding Centralized Security Management for AWS Accounts
Learn how to choose the right AWS service for centralized security management across multiple accounts. This post breaks down a key exam question.
An e-commerce company is managing multiple AWS accounts for different business units. They want a centralized security management solution to monitor compliance across all accounts. This decision often trips candidates up. Let's break it down.
The question
An e-commerce company is using multiple AWS accounts for different business units. They want to implement a centralized security management solution to monitor compliance across all accounts. Which service should they use to achieve this goal?
A. AWS Organizations with Service Control Policies
B. AWS Security Hub
C. AWS Config Aggregator
D. Amazon GuardDuty
Think before you scroll
Consider the requirements of centralized security management and compliance monitoring. The ideal service should aggregate security alerts and provide insights across multiple accounts.
The answer
The correct option is B. AWS Security Hub. This service provides a centralized view of security alerts and compliance status across multiple AWS accounts. It is specifically designed to consolidate security findings, making it perfect for the company’s needs.
Why the other options lose
A. AWS Organizations with Service Control Policies: This service is primarily for managing accounts and applying policies at an organizational level. It does not monitor compliance or provide a view of security across accounts, which is essential for this scenario.
C. AWS Config Aggregator: While AWS Config Aggregator can collect compliance data from multiple accounts, it lacks the comprehensive security visibility that Security Hub offers. It focuses more on resource configuration compliance rather than security alerts.
D. Amazon GuardDuty: GuardDuty is excellent for threat detection and monitoring malicious activity. However, it does not provide the centralized compliance monitoring required in this case. Its focus is narrower than what the e-commerce company needs.
The concept behind it
Centralized security management involves aggregating security information to monitor compliance across multiple accounts. AWS Security Hub excels in this area by collecting data from various services and providing a unified view of security alerts and compliance status.
Exam trap to remember
Remember: prioritize services that provide centralized visibility over compliance and security alerts when dealing with multiple AWS accounts. Security Hub is your go-to.