1. Assessment Phase

  • AWS Multi-Account Best Practices Assessment Execution
20 Credits

AWS Multi-Account Best Practices Report

Overview

This report assesses AWS resources against 29 enabled configuration checks across the areas below. It identifies passed and failed checks, unavailable evidence, and affected resources so you can prioritize configuration changes and investigate operational gaps.

EC2 Transit Gateways

  • EC2 Transit Gateway Auto Cross-Account Attachment Disabled
  • EC2 Transit Gateway Auto VPC Attach is Disabled

Organization CloudTrail Trails

  • Organizations CloudTrail Trail is Enabled

Organizations Delegated Administration

  • Access Analyzer Management is Delegated in the Organization

Organizations Backup Policies

  • AWS Organizations Backup Policies Configured

Organizations Tag Policies

  • AWS Organizations Tag Policies Enabled

AWS Organizations Settings

  • Ensure All Features are Enabled for the Organization

Organizations Service Control Policies

  • SCP to Deny Root Account Usage
  • SCP to Protect CloudTrail
  • SCP to Protect GuardDuty
  • SCP to Protect Accounts from Leaving Organizations
  • SCP to Protect Security Hub

GuardDuty Organization Settings

  • GuardDuty Security Findings are Aggregated to a Dedicated Account
  • GuardDuty Management is Delegated in the Organization

Security Hub Organization Settings

  • Security Hub Findings Aggregated to Dedicated Security Account
  • Security Hub Finding Cross-Region Aggregation is Configured
  • Security Hub Auto-Enroll Accounts in the Organization
  • Security Hub Management is Delegated in the Organization

Inspector Organization Settings

  • Inspector Findings Aggregated to a Dedicated Security Account
  • Inspector Management is Delegated in the Organization

Macie Organization Settings

  • Macie Findings are Aggregated to a Dedicated Account
  • Macie Management is Delegated in the Organization

Resource Access Manager Shares

  • Resource Shares Shared Inside Organization Only

Backup Replication

  • Backup Cross-Account Replication

S3 Replication

  • S3 Bucket Cross-Account Replication

ECR Registry

  • ECR Registry Cross-Account Replication Enabled

CloudTrail Trails

  • Ensure that a Multi-Region CloudTrail Trail is Configured
  • CloudTrail Global Services Enabled

Service Catalog Portfolios

  • Service Catalog portfolios should be shared within an AWS organization only

The report includes actionable findings and remediation guidance for supported checks.