Split ComplianceAccount to SecurityAccount and LogArchiveAccount - Githubissues

org-formation / org-formation-reference

A reference architecture which aims to provide some best practices for any AWS Organization starting out using org-formation.

91 stars 23 forks source link

Split ComplianceAccount to SecurityAccount and LogArchiveAccount #2

Closed OlafConijn closed 3 years ago

OlafConijn commented 3 years ago

Currenlty we have a ComplianceAccount in the repo. this account will, however, host two different types of resources:

log archival for Config, CloudTrail, etc.
the delegated administration controls for GuardDuty, SecurityHub.

I would propose to split this in two:

LogArchiveAccount for log archival. Access would be very incidental, any access to this account could break glass.
SecurityAccount for it-sec and compliance tools. Access would be part of a security officers day-to-day routine