AWS::CloudFormation::GuardHook - Enhancement - Native centralized aggregation of Managed Hook invocation results across AWS Organizations

### Name of the resource

Other

### Resource name

AWS::CloudFormation::GuardHook

### Description
We are using AWS CloudFormation Managed Hooks (via Control Catalog) across a large AWS Organizations environment (~600+ accounts) to enforce governance controls.

"Proactive controls as Hooks – Evaluates resources using proactive controls from the AWS Control Tower Control Catalog".

While Managed Hooks meet our enforcement requirements, we’ve identified a significant gap in centralized observability and reporting of hook invocations.

With the introduction of the Hooks Invocation Summary page (September 2025) and granular invocation details (November 2025), CloudFormation now provides excellent per-account visibility into Hook activity — including which controls were invoked, execution details, and outcomes (pass, warn, fail).

However, for organizations managing dozens or hundreds of accounts via AWS Organizations, there is no native mechanism to aggregate and view Hook invocation results across all member accounts from a single pane of glass. This creates significant operational overhead for centralized governance, compliance, and security teams who need organization-wide visibility into Hook enforcement outcomes.

Current Workarounds
Today, achieving cross-account aggregation requires stitching together multiple services manually:

EventBridge cross-account event forwarding — Setting up rules in each member account to forward CloudFormation Hook events to a central event bus in a management/audit account.
CloudWatch Logs + StackSets — Deploying logging infrastructure via StackSets and using CloudWatch Logs Insights for querying.
S3 + Athena — Routing events to a centralized S3 bucket and querying with Athena.
AWS Config Organization Aggregator — Provides some compliance data but does not capture granular Hook invocation details (e.g., individual control findings, severity, remediation advice).
These workarounds are complex to set up, maintain, and scale — especially as new accounts are added to the Organization.

Requested Feature
A native, organization-wide aggregation capability for Managed Hook invocation results, accessible from a delegated administrator or management account. Ideally, this would include:

Centralized dashboard/console view — Similar to the existing per-account Hooks Invocation Summary, but aggregated across all accounts and OUs in the Organization.
Cross-account querying — Ability to filter and search Hook invocation results by account, OU, region, hook type, outcome (pass/warn/fail), severity, and time range.
Compliance reporting — Exportable summaries showing organization-wide Hook compliance posture (e.g., percentage of resources passing all Hooks, top failing controls, trends over time).
Delegated administrator support — Allow a designated audit/security account to access aggregated results without requiring management account credentials.
API support — Programmatic access to aggregated results via ListHookResults or a new API that supports cross-account queries with Organizations integration.

Use Cases
Central Security/Compliance Team — Needs a single view of all Hook enforcement outcomes across the organization to ensure policy compliance and generate audit reports.
Incident Response — Quickly identify which accounts/regions have failing Hooks to prioritize remediation.
Executive Reporting — Provide leadership with organization-wide compliance dashboards without manual data aggregation.
Drift Detection — Identify accounts where Hooks are not deployed or are producing unexpected results compared to organizational baselines.

Proposed Implementation Approach
This could follow patterns already established by other AWS services:

AWS Config — Organization-wide aggregator with delegated administrator support
AWS Security Hub — Cross-account findings aggregation
AWS CloudTrail — Organization trails with centralized logging
AWS User Notifications — Managed notification aggregation for Organizations
Impact
This feature would significantly reduce the operational burden on organizations using CloudFormation Hooks at scale and would make Hooks a more compelling choice for enterprise-wide governance and compliance enforcement.

### Other Details

_No response_

No repository files, tests, or entry points are identified. Start by reviewing the existing CloudFormation Hooks Invocation Summary and the listed cross-account workarounds, then assess the requested organization-wide dashboard, querying, reporting, delegated administration, and API support; done would mean a defined native aggregation capability meeting those requirements.

Written by the indexing model from the issue text.