AWS Security Hub

AWS Security Hub gives a single view of the security state of your accounts. It collects findings from GuardDuty, Inspector, Macie, AWS Config and partner products in a common format, and runs automated checks against standards: AWS Foundational Security Best Practices, CIS AWS Foundations, PCI DSS and NIST. It can aggregate across accounts and regions, and findings can trigger EventBridge rules.

With Terraform: aws_securityhub_account, aws_securityhub_standards_subscription and the organization admin resources. See security monitoring.