Teams running an AWS Organization
Every new account is a new blind spot, and nobody remembers to onboard it.
Every account your organisation owns is covered automatically — including the ones created next month, without anyone remembering to add them.
The role name is fixed, so every member account’s role ARN is derived rather than configured. We enumerate the organisation from the management account and assume the same role name in each. An account created later is covered on placement and scanned on the next run — no one has to remember anything.
An account we cannot see properly does not get a confident score. Where visibility is incomplete, StationChief says so and names what is missing, rather than reporting a reassuring number calculated over a subset nobody disclosed. A silently partial score is worse than no score, because you act on it.
All 117 best practices are evaluated against every account on the same schedule, so posture is comparable across the organisation rather than varying with how much attention each account happened to get. Where the same condition is found more than once, it collapses to one item instead of inflating the count.
Invite-only while we onboard deliberately. We reply either way.