Designate an account to be the delegated Amazon GuardDuty administrator account.
Turn on GuardDuty for all accounts across the organization. In the GuardDuty administrator
account, create an SNS topic. Subscribe the SecOps team's email address to the SNS topic. In the same
account, create an Amazon EventBridge rule that uses an event pattern for GuardDuty findings and a
target of the SNS topic.

Create an AWS CloudFormation template that creates an SNS topic and subscribes the

SecOps team’s email address to the SNS topic. In the template, include an Amazon EventBridge rule uses an event pattern of CloudTrail activity for s3: PutBucketPublicAccessBlock and a target of the SNS topic. Deploy the stack to every account in the organization by using CloudFormation StackSets.

Turn on AWS Config across the organization. In the delegated administrator account, create an SNS
topic. Subscribe the SecOps team's email address to the SNS topic. Deploy a conformance pack that
uses the s3-bucket-level-public-access-prohibited AWS Config managed rule in each account and
uses an AWS Systems Manager document to publish an event to the SNS topic to notify the SecOps
team.

Turn on Amazon Inspector across the organization. In the Amazon Inspector delegated
administrator account, create an SNS topic. Subscribe the SecOps team’s email address to the SNS
topic. In the same account, create an Amazon EventBridge rule that uses an event pattern for public
network exposure of the S3 bucket and publishes an event to the SNS topic to notify the SecOps
team