Question

A company manages baseline networking (VPCs, subnets, VPC endpoints) across 40 accounts in an AWS Organization using a service-managed CloudFormation StackSet. The security team wants to guarantee that any manual change to a deployed stack instance is automatically detected, reported centrally, and then reverted to the template-defined configuration within 24 hours, without requiring an engineer to log into member accounts. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Create an EventBridge scheduled rule in the management account that triggers a Lambda function to run StackSet drift detection daily, and on detecting DRIFTED instances, invokes a StackSet operation that re-deploys the current template to overwrite the drifted resources.

Answer

Enable AWS Config in each account with an organization conformance pack that flags noncompliant VPC resources, then manually re-deploy the StackSet when findings appear.

Answer

Convert the networking baseline to an AWS CDK application and run 'cdk deploy' from a nightly CodeBuild job assuming a role in each account to force the desired state.

Answer

Enable drift detection on the StackSet and rely on the automatic remediation feature of StackSets to revert drifted stack instances on a schedule.