An enterprise runs hundreds of AWS accounts under Organizations. The security team needs continuous, centralized evaluation of every account against PCI DSS requirements such as no public S3 buckets, encrypted EBS volumes, and enabled CloudTrail. Which service provides this consolidated compliance view?
Show answer and explanation
Answer: C
AWS Security Hub evaluates accounts against compliance standards including PCI DSS, CIS AWS Foundations Benchmark, and AWS Foundational Security Best Practices, producing scored, control-by-control findings. With a delegated administrator enrolling the whole organization, those standards are checked in every account and roll up into one central dashboard.
It also ingests findings from services such as GuardDuty, Inspector, Macie, Config, and IAM Access Analyzer, so the compliance picture and the detection picture line up in the same place.
Why the other options are wrong
- A. A Config aggregator collects configuration state and rule results across accounts, but it does not score the environment against PCI DSS controls the way Security Hub does, and it lacks the cross-service findings correlation.
- B. GuardDuty consolidates threat-detection findings across accounts; it has no concept of compliance frameworks and never produces a PCI DSS assessment.
- D. Inspector reports software vulnerabilities and network exposure within its scanning scope; it does not evaluate accounts against a multi-account compliance standard.