What should the security engineer do to resolve this issue?
Set up an Amazon CloudWatch Events rule to forward all GuardDuty findings to the security account. Use an AWS Lambda function as a target to raise findings.
Set up an Amazon CloudWatch Events rule to forward all GuardDuty findings to the security account. Use an AWS Lambda function as a target to raise findings in AWS Security Hub.
Check that GuardDuty in the security account is able to assume a role in the compromised account using the guardduty;listfindings permission. Schedule an Amazon CloudWatch Events rule and an AWS Lambda function to periodically check for GuardDuty findings.
Use the aws guardduty get-members AWS CLI command in the security account to see if the account is listed. Send an invitation from GuardDuty in the security account to GuardDuty in the compromised account. Accept the invitation to forward all future GuardDuty findings.
Explanations:
Setting up a CloudWatch Events rule to forward GuardDuty findings using a Lambda function to raise findings does not ensure that all findings are centralized in the security account. Instead, it merely creates additional findings based on existing ones without properly integrating GuardDuty findings from the member accounts into the centralized account.
Similar to option A, using a CloudWatch Events rule to forward GuardDuty findings to the security account and then raising them in AWS Security Hub does not provide a proper solution for centralizing findings. This option also fails to guarantee that all GuardDuty findings will be available in the security account, as it does not integrate GuardDuty findings directly.
Checking if the GuardDuty in the security account can assume a role in the compromised account is not necessary for forwarding findings. GuardDuty findings should be shared automatically across accounts in an AWS Organization. Scheduling a CloudWatch Events rule to periodically check for findings does not ensure real-time or complete visibility of findings from member accounts.
This option correctly identifies that using the AWS CLI to check if the security account is a member of the GuardDuty setup in the compromised account and then sending an invitation for membership allows the centralized account to receive all future GuardDuty findings from the member account. This is the proper way to ensure all findings are available in the centralized security account.
From what I’ve heard, the answer is:
Use the aws guardduty get-members AWS CLI command in the security account to see if the account is listed. Send an invitation from GuardDuty in the security account to GuardDuty in the compromised account. Accept the invitation to forward all future GuardDuty findings.