Multi-Account CSPM Dashboard

Monitor your entire AWS organization's security posture from one dashboard.

Introduction

30 Second Summary

Imagine your company uses dozens of cloud accounts, but a security gap in any one of them could expose the entire organization. Without a single place to see all misconfigurations, critical problems hide in plain sight.

In this project, you will build a centralized Cloud Security Posture Management (CSPM) dashboard that monitors multiple AWS accounts from one screen. You will enable automated scanning, aggregate findings across regions, and create automation rules that surface the most critical issues first.

What You'll Build

You will sign into a single AWS console and see the security posture of your entire organization at a glance, with real findings appearing within minutes and automation handling the noise for you.

By the end of this project, you'll have:

A live security score showing your organization's overall compliance percentage, with real findings appearing on a brand-new account within minutes of enabling CSPM.
A unified multi-account dashboard displaying findings broken down by account, region, severity, and resource type from a single delegated administrator account.
Cross-region aggregation pulling security findings from multiple AWS regions into one home region, plus automation rules that suppress low-priority noise so you focus on what matters.
Secret Mission: An automation rule that elevates severity to CRITICAL for specific high-value resources, ensuring your most important assets always surface at the top of the triage queue.

Are there any prerequisites?

None. This guide walks you through creating an AWS account, setting up AWS Organizations, and enabling Security Hub CSPM from scratch. No prior AWS experience is required.

Before We Start

Before We Start...

Before we dive in, let's lock in what you're about to build and why it matters.

Create Your AWS Account and Organization

To monitor security across multiple cloud accounts, you first need the accounts themselves. AWS requires an account to access any service, and an Organization to manage multiple accounts centrally.

In this step, you will create a brand-new AWS account, set up an AWS Organizations structure, and add a second member account. This gives you the multi-account foundation that the rest of the project builds on.

In this step, get ready to:

Create a new AWS account and sign into the AWS Management Console.
Create an AWS Organization with your account as the management account.
Create a member account within the organization.

Create a new AWS account

Every AWS service lives behind an account. You will create one from scratch so you start with a clean slate for this project.

Open https://aws.amazon.com in your browser.
Click Create an AWS Account (or Create a Free Account if shown).
Enter your email address and choose an account name (e.g. your name or project name).
Click Verify email address and enter the verification code sent to your inbox.
Create a strong root user password and click Continue.
Enter your contact information and accept the AWS Customer Agreement.
On the Payment Information page, enter a valid payment method. Your card will not be charged for this project during the free trial.
Complete the phone verification step by entering the code sent via SMS or voice call.
On the Select a support plan page, choose Basic Support - Free.
Click Complete sign up.

Account activation usually takes a few minutes but can take up to 24 hours. Check your email for the activation confirmation before continuing.

Once activated, sign in to the AWS Management Console at https://console.aws.amazon.com using your root user email and password.

Account not activating?

Activation typically completes within minutes. If you have been waiting more than 30 minutes, check your spam folder for the confirmation email. If you still see a Complete Sign Up button after signing in, your account may still be activating. Wait and try again shortly.

Help me troubleshoot my AWS account activation

Create an AWS Organization

An Organization lets you manage multiple AWS accounts as a single unit. Your current account becomes the management account, which is the central hub for governance and billing.

In the AWS Management Console, click the search bar at the top and type Organizations.
Select AWS Organizations from the results.
On the introduction page, click Create an organization.
In the confirmation dialog, click Create an organization again.

AWS creates the organization with all features enabled by default and shows you the AWS accounts page. Your account is now listed as the management account.

What is AWS Organizations?

AWS Organizations is a service that lets you consolidate multiple AWS accounts into a hierarchy you manage centrally. The account that creates the organization becomes the management account. It can create new member accounts, apply governance policies, and enable services across all accounts.

The organization is created with "all features" enabled, which means you can use security policies and delegate administration to other accounts later.

Don't see the AWS accounts page?

If you land on a different page after creating the organization, click AWS accounts in the left navigation pane to find your accounts list.

Help me find the AWS accounts page in Organizations

Create a member account

Your organization currently has one account. To build a multi-account environment (which is standard in enterprise security), you need at least one more. Creating a member account within Organizations is instant and does not require a separate sign-up process.

On the AWS accounts page in the Organizations console, click Add an AWS account.
Select Create an AWS account.
In the AWS account name field, enter Security-Member-Account.
In the Email address of the account's owner field, enter a unique email address for this account's root user. This must be different from your management account email.
Leave the IAM role name field blank to use the default OrganizationAccountAccessRole.
Click Create AWS account.

Use a plus-alias for the email

If you use Gmail or a similar provider, you can add a plus sign to your existing address (e.g. yourname+security@gmail.com). This creates a unique address that still delivers to your main inbox.

The new account should appear on the AWS accounts page within a few seconds. You may need to refresh the page to see it.

What is OrganizationAccountAccessRole?

When you create a member account through Organizations, AWS automatically creates an IAM role called OrganizationAccountAccessRole in that account. This role allows the management account to assume access into the member account without needing separate credentials.

Account creation stuck?

Member account creation is usually instant. If the status does not change to Active after a minute, refresh the page. Make sure the email address you entered is not already associated with another AWS account.

Help me troubleshoot member account creation

Before you move on, predict what you expect to see on the AWS accounts page now. How many accounts should be listed?

You should see two accounts on the AWS accounts page: your management account and the newly created Security-Member-Account. Both should show a status of Active.

Your multi-account foundation is ready. Next up, you will enable Security Hub CSPM and see real security findings appear on your brand-new accounts within minutes.

Enable Security Hub CSPM and See Your First Findings

Your AWS Organization is set up with two accounts. But right now, you have zero visibility into the security posture of either one.

Even a brand-new AWS account has misconfigurations. No MFA on root, no logging configurations, default settings that fail security best practices. Enabling CSPM immediately starts scanning and produces real findings within minutes, giving you a tangible result before any multi-account complexity.

In this step, get ready to:

Enable Security Hub CSPM in your management account.
See real security findings appear on your dashboard.
Review findings grouped by severity level.

Enable Security Hub CSPM in your management account

Security Hub CSPM is AWS's purpose-built cloud security posture management service. Once enabled, it continuously scans your account against security best practices and flags anything that does not meet the standard.

In the AWS Management Console, click the search bar at the top of the page.
Type Security Hub and select Security Hub from the results.
On the Security Hub CSPM introduction page, choose Enable Security Hub.

What happens when you enable Security Hub CSPM?

Security Hub CSPM immediately begins scanning your account against security best practices. It checks IAM configurations, logging settings, network rules, and more.

The 30-day free trial starts now for this account and region. After the trial, pricing is based on the number of security checks performed and findings ingested.

After enabling, you should see the Security Hub CSPM console load with a Summary dashboard. It may take a few minutes for findings to begin populating.

Don't see the enable option?

Make sure you are signed into your management account (not the member account). Check the account dropdown in the top-right corner of the console to confirm which account you are using.

If Security Hub CSPM is already enabled, you will land directly on the Summary dashboard instead of the introduction page.

help me enable Security Hub CSPM in my management account

Explore your first security findings

Even a brand-new account fails multiple security checks. Those failures show up as findings on your dashboard within minutes.

Wait 2-3 minutes for the initial scan to generate findings.
Navigate to the Summary page in the left navigation panel of Security Hub CSPM.

Before you look at the dashboard, predict what you think you will see. Do you think a brand-new AWS account will have any security findings at all?

You should see a security score displayed as a percentage, along with findings already appearing on the dashboard. Common findings on a new account include missing MFA on the root user and disabled CloudTrail logging.

Note your initial security score. This is your baseline that will change as you address or suppress findings later.

Why does a brand-new account already have findings?

AWS accounts ship with default configurations that prioritize ease of use over security. No MFA on root, no audit logging, no encryption defaults. Security Hub CSPM catches all of these immediately.

This is exactly what makes CSPM valuable. You do not need to deploy any resources to see it working.

Not seeing any findings yet?

Findings can take up to 5 minutes to appear after enabling. Refresh the Summary page and wait a moment. Security scores and control statuses refresh every 24 hours, but individual findings appear much sooner.

my Security Hub CSPM dashboard is not showing any findings after enabling

Review findings by severity

Findings are categorized by severity so you know what to fix first. Let's drill into the details.

In the left navigation panel, click Findings.
Look at the severity labels assigned to each finding: CRITICAL, HIGH, MEDIUM, LOW, and INFORMATIONAL.
Click on any individual finding to expand its details.
In the finding detail view, review which resource it relates to and read the remediation guidance provided.

What do the severity levels mean?

CRITICAL and HIGH findings represent misconfigurations that could lead to data exposure or unauthorized access. These are the ones a security team would fix first.

MEDIUM and LOW findings are less urgent but still worth tracking. INFORMATIONAL findings are observations rather than problems.

The Security Hub CSPM Summary dashboard now shows a security score and lists findings grouped by severity. You can see at least several findings even on a brand-new account.

You now have a live CSPM dashboard scanning your management account and surfacing real security gaps. Next up, you will go multi-account by designating a delegated administrator so you can see findings from both accounts in one place.

Designate a Delegated Administrator for Multi-Account Visibility

Your Security Hub CSPM dashboard is live and scanning your management account for misconfigurations. You can already see findings revealing security gaps. But right now, you only have visibility into a single account.

In a real organization, security teams need to monitor all accounts from one location. In this step, you will designate a delegated administrator account that centralizes findings from your entire organization into a single dashboard.

In this step, get ready to:

Designate the member account as the Security Hub CSPM delegated administrator.
Sign into the delegated administrator account and confirm multi-account visibility.
Enable central configuration to apply Security Hub CSPM across all organization accounts.

Designate the delegated administrator

A delegated administrator is a separate account that manages Security Hub CSPM on behalf of the entire organization. Instead of running security operations from your management account, you delegate that responsibility to a dedicated account.

In the Security Hub CSPM console (you should already be here from the previous step), click Settings in the left navigation panel.
Click General.
Scroll down to the Delegated administrator section.
Click Configure.
Enter the account ID of your member account (Security-Member-Account), or select it from the list that appears.
Click Save.

The member account now appears as the delegated administrator in the Delegated administrator section.

Why use a separate account as the delegated administrator?

AWS recommends keeping your management account for billing and organization-level tasks only. Security operations belong in a separate, dedicated account. This limits who has access to the management account and follows the principle of least privilege.

Find your member account ID

If you need the account ID, search for Organizations in the console search bar. The AWS accounts page lists each account with its 12-digit ID.

Don't see the Configure option?

Make sure you are in the management account (check the account name in the top-right corner). Only the management account can designate a delegated administrator.

Also confirm that Security Hub CSPM is enabled in this account and region. If the Settings page looks empty, return to the Security Hub CSPM main page and enable the service first.

help me designate a delegated administrator in Security Hub CSPM

Sign into the delegated administrator account

Now you need to switch to the member account to confirm it has Security Hub CSPM access. Since you are signed in as the root user, you will sign into the member account directly using its root email.

Click your account name in the upper-right corner of the console.
Click Sign out.
On the AWS sign-in page, select Root user.
Enter the email address you used when creating the Security-Member-Account.
Click Next.
Click Forgot password? to set a password for this account. AWS sends a reset link to the member account email address.
Open the reset email, click the link, and set a new password for the member account.
Sign in to the member account using the email and your new password.

Why do I need to reset the password?

When you create a member account through AWS Organizations, the account does not have a root password set. The only way to sign in as that account's root user for the first time is to use the password reset flow with the email you provided during creation.

Once signed in, search for Security Hub in the top search bar and open the Security Hub CSPM console.

Security Hub CSPM should already be enabled in this account because it was designated as the delegated administrator. You should see the Summary dashboard with findings appearing.

Security Hub CSPM not enabled in the member account?

If you see a prompt to enable Security Hub CSPM, go ahead and enable it. The delegated administrator designation sometimes requires you to activate the service in the account before the central features become available.

help me enable Security Hub CSPM in my delegated administrator account

Enable CSPM for member accounts via central configuration

Now that you are in the delegated administrator account, you need to configure a policy that enables Security Hub CSPM scanning across all organization accounts. This ensures both accounts are scanned and their findings are visible from this single dashboard.

In the Security Hub CSPM console (delegated administrator account), click Settings in the left navigation panel.
Look for the Configuration section or Accounts tab that shows your organization's accounts.
Configure the policy to enable Security Hub CSPM in all organization accounts. Select central configuration so that the delegated administrator manages Security Hub CSPM settings for all accounts.
Confirm your changes.

What is central configuration?

Central configuration lets the delegated administrator manage Security Hub CSPM settings across all accounts in the organization from one place. Instead of signing into each account individually to enable CSPM, you set a single policy that applies everywhere.

This means new accounts added to the organization in the future will automatically have Security Hub CSPM enabled and managed by the delegated administrator.

Before you check the dashboard, what do you expect to see now that central configuration is enabled? Do you think findings from the management account will appear alongside findings from the member account?

Navigate back to the Security Hub CSPM Summary dashboard.
Look at the Accounts with the most findings (by severity) widget.

You should see data from both accounts listed in the widget. The dashboard now aggregates findings from the management account and the member account into a single view. This is multi-account visibility in action.

What if I only see one account's findings?

Findings from the management account may take a few minutes to appear in the delegated administrator's dashboard after central configuration is applied. Wait 2-3 minutes and refresh the page. The Accounts with the most findings (by severity) widget will update as findings replicate.

Still only seeing one account after several minutes?

Make sure you enabled central configuration from the delegated administrator account, not the management account. Check that both accounts appear in the Accounts section of Settings with their status showing as enabled.

Also verify you are in the correct region (us-east-1). Findings only appear in the region where Security Hub CSPM is enabled for each account.

help me see findings from both accounts in my delegated administrator dashboard

Your dashboard now shows the security posture of your entire organization from a single account. Next up, you will configure cross-region aggregation to pull findings from multiple AWS regions into this same view.

Configure Cross-Region Aggregation

Your CSPM dashboard now shows findings from both accounts. That is a big step forward for visibility.

However, it only covers the region you are currently signed into (us-east-1). If resources exist in other regions, those security gaps are completely invisible. Cross-region aggregation pulls all findings into one home region so nothing slips through the cracks.

In this step, get ready to:

Configure a finding aggregator with us-east-1 as the home region.
Link additional regions for unified visibility across your organization.
Verify multi-region findings appear in a single dashboard.

Configure the finding aggregator

A finding aggregator is a resource that designates one region as the "home" for all your security data. Findings from other linked regions get replicated into this home region automatically.

In the delegated administrator account's Security Hub CSPM console, click Settings in the left navigation menu.
Click Regions.
Click Configure finding aggregation.
Under Aggregation Region, select the option to designate the current region (us-east-1) as the home region.

What is a home region?

The home region (also called the aggregation region) is where all replicated findings are stored and displayed. You will only need to check one region's dashboard to see your entire organization's security posture.

Any automation rules you create in the aggregation region will also apply across all linked regions.

Link additional regions

With the home region set, you now choose which other regions should send their findings here.

Under Linked Regions, select us-west-2.
Also select eu-west-1.
Select Link future Regions to automatically aggregate data from any new regions as they become available.
Click Save.

Why link future regions?

AWS regularly adds new regions. Enabling this option means any region launched in the future is automatically linked to your aggregator. Without it, a new region's findings would be invisible until you manually add it.

The finding aggregator is now configured. Findings from us-west-2 and eu-west-1 will begin replicating to your home region.

Verify aggregation is working

Findings from linked regions can take a few minutes to start appearing. Let's confirm the aggregation is active.

Navigate back to the Security Hub CSPM Summary dashboard.
Wait 2-3 minutes for findings to begin replicating from linked regions.

Before you look at the dashboard, think about what you expect to see. Do you think findings from other regions will appear immediately, or will the counts stay the same as before?

Look at the Findings by Region widget on the Summary dashboard.

The Findings by Region widget should now show findings from your linked regions (us-west-2 and eu-west-1). Your overall findings count has increased to include findings from all linked regions and both accounts.

What if findings from linked regions have not appeared yet?

Cross-region aggregation replicates findings to the home region. Many findings appear within minutes, but full replication can take up to 24 hours. If you do not see data from linked regions immediately, check back after a few more minutes.

Findings by Region widget only shows one region?

Confirm you selected both us-west-2 and eu-west-1 in the Linked Regions section. Go back to Settings > Regions to verify they are listed.

Also make sure you clicked Save after configuring. If you navigated away without saving, the aggregator was not created.

Still stuck? Why is my cross-region aggregation not showing findings from linked regions?

Your dashboard now shows a unified view across all linked regions and both accounts from a single pane of glass. Next up, you will customize this dashboard and create automation rules that triage findings by severity without any manual work.

Customize Your Dashboard and Create Automation Rules

Your dashboard now pulls security findings from multiple accounts and regions into a single view. The next challenge is making that data actionable.

The default dashboard shows everything at once, which makes it difficult to identify which accounts are most at risk or what to fix first. In this step, you will customize your dashboard layout and create an automation rule that filters out noise so you can focus on what matters.

In this step, get ready to:

Customize the Summary dashboard with severity, region, and resource type widgets.
Create an automation rule to suppress informational findings.
Confirm the rule is working and verify a cleaner dashboard view.

Customize the Summary dashboard

A security team reviewing dozens of accounts needs to see the most critical information at a glance. You will add widgets that surface findings by severity, by region, and by resource type.

Switch back to the Security Hub CSPM Summary dashboard in your delegated administrator account.
Click Add widgets at the upper-right corner of the page.
In the search bar, type Accounts with the most findings (by severity) and drag the widget onto the dashboard.
Click Add widgets again.
Search for Findings by Region and drag it onto the dashboard.
Click Add widgets one more time.
Search for Accounts with the most findings by resource type and drag it onto the dashboard.
Remove any widgets that are not relevant to your two-account setup by clicking the three dots in the upper-right corner of the widget and selecting the remove option.

Your dashboard now shows a focused operational view with three key dimensions: severity, geography, and resource type.

Why these three widgets?

Each widget answers a different triage question. Accounts with the most findings (by severity) tells you which account needs attention first.

Findings by Region reveals whether misconfigurations are concentrated in a specific region. Accounts with the most findings by resource type shows whether the issue is IAM, S3, or another service.

Don't see a widget in the search?

Make sure you are on the Summary page in the navigation pane. Widget names are case-sensitive in the search bar, so try typing the first few characters and selecting from the suggestions.

help me find the right widgets on my Security Hub CSPM dashboard

Create an automation rule to suppress informational noise

Your dashboard currently shows findings of every severity level, including INFORMATIONAL findings that indicate no configuration weakness. An automation rule can automatically suppress these low-priority findings so you can focus on HIGH and CRITICAL issues.

In the Security Hub CSPM navigation pane, choose Automations.
Choose Create rule.
For Rule Type, choose Create custom rule.
In the Rule section, enter Suppress informational findings as the rule name.
Under Criteria, set the Key to SeverityLabel.
Set the Operator to EQUALS.
Set the Value to INFORMATIONAL.

What do these criteria mean?

This rule targets every finding with a severity label of INFORMATIONAL. These findings indicate no configuration weakness. They exist to show compliance but do not require action.

Under Automated action, set Workflow Status to SUPPRESSED.
Add a note with the text: Auto-suppressed by automation rule.
Under Rule status, select Enabled.
Choose Create rule.

What does this rule do?

When Security Hub CSPM ingests a new finding with an INFORMATIONAL severity label, this rule automatically sets its workflow status to SUPPRESSED. Suppressed findings are still accessible if you need them, but they no longer appear in your default dashboard view.

Because you created this rule in your aggregation region (us-east-1), it applies across all linked regions automatically.

Rule creation failed?

Make sure you are signed into the delegated administrator account. Automation rules can only be created from a Security Hub CSPM administrator account.

Also confirm you have at least one criterion and one action defined before clicking Create rule.

help me troubleshoot why my Security Hub CSPM automation rule failed to create

Confirm the rule is working

Before you check the dashboard, think about what you expect to change. Do you think the total finding count will go up or down now that informational findings are suppressed?

In the navigation pane, choose Automations to confirm your rule appears with a status of Enabled.
Navigate back to the Summary dashboard.
Check the Accounts with the most findings (by severity) widget.

You should see fewer findings overall. The INFORMATIONAL category should be absent or greatly reduced, leaving a cleaner breakdown focused on HIGH and CRITICAL severity levels.

What if informational findings still appear?

Automation rules apply to new and updated findings as they are ingested. Existing findings that were already in the dashboard before the rule was created may take a few minutes to be processed. Give it 2-3 minutes and refresh the page.

Secret mission

Elevate Severity for High-Value Resources

Not all resources are equal. A misconfiguration on a production database is far more dangerous than one on a test bucket. Can you build a multi-criteria automation rule that ensures your most critical resources always surface at the top of your triage queue?

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. Security Hub CSPM has a 30-day free trial per account per region. After the trial ends, expect approximately $5-15/month for a small 2-account setup.

Cost warning

Security Hub CSPM charges per security check ($0.0010 per check) and per finding ingestion event ($0.0010 per event after the first 10,000 free) once the 30-day free trial expires. With two accounts and multiple regions enabled, costs will accumulate automatically.

If you do not plan to continue using this setup, choose Pause or Delete below to avoid unexpected charges.

Resources you used:

AWS Organization with 2 accounts (management account and Security-Member-Account).
Security Hub CSPM enabled in both accounts (us-east-1).
Cross-region aggregation (home region us-east-1, linked regions us-west-2 and eu-west-1).
Two automation rules (suppress informational findings, elevate severity for high-value resources).

Keep everything running

No action needed. Choose this if you are still actively building or exploring Security Hub CSPM findings across your accounts.

Your 30-day free trial continues counting down for each account and region.
After the trial, expect approximately $5-15/month for this 2-account, 3-region setup.
New findings will continue to appear as Security Hub CSPM runs periodic checks.

Pause - I'll come back to this later

Stop generating new findings to reduce costs while keeping your configuration intact.

In the delegated administrator account (Security-Member-Account), navigate to Security Hub CSPM.
Go to Settings, then Security standards.
Disable all active security standards to stop generating new findings.
Repeat in the management account if Security Hub CSPM is enabled there independently.

What does pausing do?

Disabling security standards stops new checks from running, which stops new findings from being generated. Your existing findings, automation rules, and aggregation settings remain intact. You can re-enable the standards at any time to resume scanning.

Delete - I don't want to use this again

Remove all project resources and return your accounts to their pre-project state.

Follow these steps in order:

Sign into the delegated administrator account (Security-Member-Account).
Navigate to Security Hub CSPM, then go to Settings, then General.
Choose Disable Security Hub CSPM to disable it in the delegated administrator account.
Sign into the management account.
Navigate to Security Hub CSPM, then go to Settings, then General.
Choose Disable Security Hub CSPM to disable it in the management account.

To remove the member account from the Organization:

First, deregister the delegated administrator. In the management account's Security Hub CSPM console, go to Settings, then General, then Delegated administrator. Remove the delegated administrator designation.
In the AWS Organizations console (management account), go to the AWS accounts page.
Select the checkbox next to the Security-Member-Account.
Choose Actions, then under AWS account, choose Remove from organization.
Confirm the removal in the dialog by choosing Remove account.

To delete the Organization entirely:

In the AWS Organizations console (management account), navigate to Settings.
Choose Delete organization.
Enter the organization ID in the confirmation dialog, then choose Delete organization.

What happens after deletion?

Deleting the Organization does not close your management account. It reverts it to a standalone AWS account. The member account, once removed, also becomes a standalone account responsible for its own billing.

Nice Work!

You just built a centralized cloud security posture management dashboard that monitors multiple AWS accounts from a single pane of glass. You can now sign into one account and see the security posture of your entire organization across accounts and regions.

You've learned how to:

Set up a multi-account AWS Organization and enabled Security Hub CSPM to automatically detect misconfigurations across all accounts within minutes of activation.
Centralized security visibility by designating a delegated administrator and configuring cross-region aggregation to pull findings from multiple regions into a single dashboard.
Created automation rules to suppress informational noise and focus your triage on actionable HIGH and CRITICAL findings.
Secret Mission: Built a multi-criteria automation rule to elevate severity for high-value resources, ensuring critical assets always surface at the top of your triage queue.

Ready to quiz yourself?