A financial services corporation is establishing a multi-account compliance auditing architecture using AWS Organizations. The solutions architect needs to configure AWS Config at the organization level to automatically record resource configurations and evaluate compliance using custom rules. The architect decides to delegate administrative capabilities to a dedicated Security tooling account instead of using the Organizations management account for daily compliance management. Arrange the following steps in the correct logical sequence to successfully configure this delegated compliance monitoring setup.
- 1Enable trusted access for AWS Config using the Organizations management account.
- 2Register the Security tooling account as the delegated administrator for AWS Config from the Organizations management account.
- 3Create an organization-wide AWS Config aggregator in the registered Security tooling account.
- 4Deploy organization conformance packs from the Security tooling account to apply compliance rules to all member accounts.
Answer
The correct logical sequence is to first enable trusted access for AWS Config in the Organizations management account, then register the Security tooling account as the delegated administrator, followed by creating the organization aggregator in the Security account, and finally deploying the organization conformance packs from the Security account.
To successfully establish delegated administration for compliance monitoring, trusted access for AWS Config must first be enabled in the Organizations management account. Next, the management account registers the Security tooling account as the delegated administrator. Finally, from this delegated admin account, the organization aggregator is created to gather configuration details, and the organization conformance packs are deployed to apply the compliance rules across the member accounts.
Step-by-Step Solution
Key Concept
Delegated Administration in AWS Organizations