AWS organizations: Org service configs extend to accounts joining an organization
Summary
Adds an advisory note that joining an organization can automatically apply organization-level service configurations to the member account, including CloudTrail organization trails (always applied) and optional auto-enablement of AWS Config, Amazon GuardDuty, and AWS Security Hub CSPM, warning about duplicate charges and overlapping configurations.
Security assessment
The added text explains that organization-level logging, configuration recording, and threat-detection services (CloudTrail, Config, GuardDuty, Security Hub CSPM) may be applied automatically to newly joined accounts. This is security-adjacent guidance about audit/detection coverage being inherited, though it is framed around cost and configuration overlap rather than fixing any vulnerability.
Evidence
When your account joins an organization, organization-level service configurations can extend to your account automatically. AWS CloudTrail organization trails always apply to newly joined accounts. Other services, including AWS Config, Amazon GuardDuty, and AWS Security Hub CSPM, can be configured to enable automatically for new member accounts.
Diff
diff --git a/organizations/latest/userguide/orgs_manage_accounts_invites.md b/organizations/latest/userguide/orgs_manage_accounts_invites.md index a3bd52e4f..98ceaee1a 100644 --- a//organizations/latest/userguide/orgs_manage_accounts_invites.md +++ b//organizations/latest/userguide/orgs_manage_accounts_invites.md @@ -77,0 +78,6 @@ You can invite an account to join an organization that has only the consolidated +**Organization-level service configurations might extend to your account** + +When your account joins an organization, organization-level service configurations can extend to your account automatically. AWS CloudTrail organization trails always apply to newly joined accounts. Other services, including AWS Config, Amazon GuardDuty, and AWS Security Hub CSPM, can be configured to enable automatically for new member accounts. + +These services incur usage-based charges, and any existing account-level configurations might result in duplicate charges. Before accepting an invitation, review organization-level and account-level configurations for overlap. For information about transitioning from an account-level trail to an organization trail, see [Moving from member account trails to organization trails](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-an-organizational-trail-best-practice.html). +