A company recently created a new AWS Control Tower landing zone in a new organization in AWS Organizations. The landing zone must be able to demonstrate compliance with the Center for Internet Security (CIS) Benchmarks for AWS Foundations. The company’s security team wants to use AWS Security Hub to view compliance across all accounts. Only the security team can be allowed to view aggregated Security Hub findings. In addition, specific users must be able to view findings from their own accounts within the organization. All accounts must be enrolled in Security Hub after the accounts are created. Which combination of steps will meet these requirements in the MOST automated way? (Choose three.)
Select 3 answers.
Marked answer: A
This question asks for 3 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose ADE1
you can use SCP to prevent access to other teams except security team by using condition in the policy .
Chose ACE1
D. An SCP that denies access to Security Hub is too broad and could interfere with legitimate access by account owners who need to see their own findings.
Chose ADE1
I prefer "D" over "C", because no-one asks to enable SSO (which is very complex to organise and maintain)
