Skip to main content

Organization Services

Organization Services is the home for the AWS services that Prism manages across all your AWS accounts, so you configure them once from a central place instead of account by account. Three services are available.

CloudTrail​

Create and manage AWS CloudTrail trails across every account with centralized logging configuration. From CloudTrail you can:

  • Create and edit organization or per-account trails.
  • Choose which management, data, insight, and network-activity events to record.
  • Route logs to centralized storage for audit and investigation.

Open the CloudTrail guide | Quick start: create your first trail

Security Hub​

Centralize cloud security posture management, threat detection, data security, vulnerability management, security investigation, access analysis, and firewall policy across your organization, configured from one place rather than account by account. Security Hub brings together nine capabilities. Eight of them are security capabilities; the ninth, VPC IPAM, is organization-wide IP address management rather than a security tool, and lives here because it is deployed across your accounts the same way.

  • Security Hub CSPM: evaluate every enrolled account against AWS compliance standards, with per-standard scores and a control-level drill-down.
  • GuardDuty: continuous threat detection with a severity-ranked threats dashboard and per-account findings.
  • AWS Config: the recording foundation that Security Hub standards depend on, provisioned and managed for you.
  • Amazon Macie: S3 data-security posture and sensitive-data findings, with a bucket-posture inventory and opt-in automated sensitive-data discovery.
  • Amazon Inspector: software vulnerability scanning of EC2 instances, container images, Lambda functions, and code repositories, with estate-wide CVE prioritisation.
  • Amazon Detective: behavior-graph investigation of the IAM users and roles involved in a security event, with accounts joining one administrator's behavior graph by invitation.
  • AWS IAM Access Analyzer: external-access analysis of the resource policies in your accounts, plus opt-in unused-access analysis of IAM roles, users, access keys and passwords.
  • AWS Firewall Manager: organization-wide AWS WAF (WAFv2) web ACL policies, applied and audited by Prism through each account's own switch role, with an orphan scanner for web ACLs a removed policy left behind.
  • VPC IPAM: organization-wide IP address management, with a discovered inventory of every VPC, subnet and Elastic IP CIDR in your enrolled accounts, address pools you allocate from, utilization, and cross-account CIDR overlap detection. Not a security capability, and the only one that requires a paid AWS tier.

Most of the security capabilities deploy from a delegated administrator account that aggregates results from enrolled members. Amazon Inspector, AWS IAM Access Analyzer and AWS Firewall Manager instead enable each account independently, with no administrator account. VPC IPAM nominates a host account that owns the IPAM and receives every other account's inventory, but that host is an ordinary enrolled account, not an AWS Organizations delegated administrator. Prism never uses your management account for any capability.

Open the Security Hub guide | Quick start: enable Security Hub | VPC IPAM

info

Security Hub and CloudFormation StackSets are beta capabilities that CloudKeeper enables together for your organization on request. Turning on the beta makes both services available; there is no separate switch for each one.

CloudFormation StackSets​

Deploy a single CloudFormation template across the accounts and regions of your organization, driven from one administration account. From the StackSets service you can:

  • Create StackSets that target organizational units, with one stack instance per account and region.
  • Update templates, sync targets as accounts join or leave your OUs, and retry failed instances.
  • Delete deployments while choosing whether the underlying stacks are retained or destroyed.

Open the StackSets guide

info

CloudFormation StackSets is part of the same beta as Security Hub. The single Organization Services beta that CloudKeeper enables for your organization unlocks both services at once.

Who can use it​

Organization Services is available to Customer Admins and to Organization Services users who have been granted access, without giving them access to the Prism Admin Portal. See Access & Organization Services Users for how access is granted.