Question

A platform team maintains a large CDK application (TypeScript) composed of dozens of stacks authored by multiple product teams. Governance requires that every S3 bucket in every stack must have server-side encryption enabled and every resource must carry a 'CostCenter' tag. The team wants to enforce these rules automatically at synthesis time so that non-compliant stacks fail the build, without asking each product team to modify their construct code. Which approach best meets these requirements?

Accepted Answer

Implement a CDK Aspect that visits every construct in the app, adds the required tags, and raises annotation errors when a bucket lacks encryption, then apply it via Aspects.of(app).add(...).

Answer

Enable CloudFormation drift detection on all deployed stacks and configure a nightly EventBridge rule to alert when buckets are found unencrypted or untagged.

Answer

Create an AWS Config conformance pack with managed rules for S3 encryption and required tags, deployed across the accounts via a StackSet.

Answer

Add a Service Control Policy that denies s3:CreateBucket unless encryption and the CostCenter tag are specified in the request.