
Build a serverless multi-account access notification system using Amazon EventBridge, AWS Lambda, and DynamoDB to alert on sensitive account logins across your AWS Organization.


<div><p>This article describes a serverless solution for notifying security teams when users access sensitive AWS accounts, using EventBridge, Lambda, DynamoDB, and SNS.</p><ul><li>Monitors console logins across multi-account AWS Organizations environments</li><li>Sends notifications for root user access and specified IAM principals</li><li>Uses DynamoDB configuration table with inclusion/exclusion rules by account, OU, or organization-wide</li><li>Deploys via two CloudFormation stacks: CentralEventBus (audit account) and ManagementAccount (org management)</li><li>Supports flexible rule matching with partial/complete principal matching logic</li><li>Exclusion rules take priority over inclusion rules</li><li>Compatible with AWS Control Tower and CloudTrail event integration</li></ul><p>This solution enables organizations to implement security best practices by automating alerts on high-risk account access without custom development.</p></div>


Related articles