Question

A platform engineering team distributes infrastructure changes across 40 AWS accounts using CDK Pipelines that deploy CloudFormation stacks. Security requires that no stack deployment be allowed to create an S3 bucket without a bucket policy denying non-TLS access, and this must be enforced at deploy time BEFORE resources are provisioned — regardless of whether developers use the correct CDK constructs. The team wants a solution that is centrally managed, applies automatically to all stack operations in every account, and blocks the CloudFormation operation itself if the rule is violated. Which approach meets these requirements?

Accepted Answer

Create a CloudFormation Hook (Guard-based) published to a private registry and activate it organization-wide via CloudFormation StackSets, configuring it in FAIL mode to block non-compliant provisioning.

Answer

Add an AWS Config managed rule (s3-bucket-ssl-requests-only) as an organization Config rule with auto-remediation via SSM Automation.

Answer

Implement a CDK Aspect in the shared construct library that validates bucket policies during synthesis and throws an error if TLS enforcement is missing.

Answer

Attach a Service Control Policy (SCP) to the organization denying s3:CreateBucket unless a bucket policy condition is present.