A company is running its application on AWS. The company has a multi-environment setup, and each environment is isolated in a separate AWS account…

This solution correctly addresses all requirements. Amazon Macie is the designated AWS service for discovering and classifying sensitive data within Amazon S3 buckets. By setting the security account as the delegated administrator for Macie within AWS Organizations, you can centrally manage and run sensitive data discovery jobs across all member accounts. Similarly, designating the security account as the delegated administrator for AWS Security Hub allows it to aggregate security findings from all accounts. The native integration between Macie and Security Hub ensures that all sensitive data findings are automatically published to and consolidated within the security account's Security Hub dashboard, providing a single location for visibility and management.

B: Amazon Inspector is a vulnerability management service for compute workloads (EC2, ECR, Lambda) and does not scan Amazon S3 buckets for sensitive data content.

C: This option is incorrect for two reasons: Amazon Inspector does not scan S3 buckets for sensitive data, and AWS Trusted Advisor is not the primary service for aggregating security findings.

D: While Amazon Macie is the correct service for discovery, AWS Trusted Advisor is not the appropriate tool for centralizing security findings; AWS Security Hub is designed for this purpose.

1. Amazon Macie Documentation - Managing multiple accounts: "With AWS Organizations, you can designate a specific member account to be the delegated Macie administrator for your organization... The delegated administrator can then enable and manage Macie for any or all of the other accounts in the organization."

Source: AWS Documentation, Amazon Macie User Guide, "Managing multiple accounts in Amazon Macie".

2. AWS Security Hub Documentation - Integrating Security Hub with Amazon Macie: "AWS Security Hub works with Amazon Macie to check for sensitive data in your Amazon Simple Storage Service (Amazon S3) buckets. Macie is a data security service that uses machine learning and pattern matching to discover and help protect your sensitive data... Macie publishes findings to Security Hub."

Source: AWS Documentation, AWS Security Hub User Guide, "Amazon Macie integration".

3. AWS Security Hub Documentation - Managing accounts with AWS Organizations: "We recommend that you use a dedicated account as the Security Hub administrator account for the organization. Using a dedicated account isolates the Security Hub configuration from your production workloads."

Source: AWS Documentation, AWS Security Hub User Guide, "Designating a Security Hub administrator account".

4. Amazon Inspector Documentation - What is Amazon Inspector?: "Amazon Inspector is a vulnerability management service that continuously scans your AWS workloads for software vulnerabilities and unintended network exposure." It scans Amazon EC2 instances, container images in Amazon ECR, and AWS Lambda functions.

Source: AWS Documentation, Amazon Inspector User Guide, "What is Amazon Inspector?".