BlueFerry Insurance uses AWS Organizations with 40 accounts across multiple Regions. Compliance requires a single Security Hub view in account SecAdmin (us-east-1) that aggregates findings from all member accounts and Regions with minimal operational overhead and no custom cross-account forwarding. What should the security architect do?

The correct answer leverages Security Hub's native multi-account and multi-Region aggregation capabilities. Designating SecAdmin as the delegated administrator allows centralized management and viewing of findings from all member accounts. Enabling Security Hub in all accounts and Regions ensures comprehensive coverage. The cross-Region finding aggregator resource in SecAdmin (us-east-1) then consolidates all these findings into a single, unified view without requiring custom forwarding or additional services, meeting the requirement for minimal operational overhead. Incorrect options: EventBridge rules for forwarding findings would introduce significant operational overhead due to the need to configure and manage rules in every account and Region. AWS Config aggregators are for AWS Config rules and compliance data, not for Security Hub findings. Security Hub does not automatically pull findings from other Regions into a home Region; explicit cross-Region aggregation is required.