Multi-Account Enterprise Topology
Production-Core
Account: 111122223333
Customer workloads, PII data stores, prod EKS
EKSRDSS3LambdaEC2
Security-Logging-Central
Account: 444455556666
Org trail archive, Security Hub aggregator, GuardDuty admin
CloudTrailSecurity HubGuardDutyMacie
Dev-CI-CD
Account: 777788889999
Build pipelines, artifact registry, deployment roles
CodeBuildECRCloudFormationIAM
Core Telemetry Ingestion Pipeline
AWS CloudTrail
● HealthyManagement & Data events
12.4k events/sec
Amazon GuardDuty
● HealthyThreat findings, all accounts
312 events/sec
AWS Security Hub
● HealthyAggregated findings + standards
846 events/sec
VPC Flow Logs
● DegradedAll prod VPCs, v5 format
48.9k events/sec
Amazon Macie
● HealthyS3 sensitive data discovery
94 events/sec
EKS Control Plane Logs
● Healthyaudit, authenticator, api
6.7k events/sec
Member AccountsOrg Trail + FirehoseSecurity-Logging-Central S3SIEM Detection Engine