Question

A company uses a CloudFormation StackSet with the SERVICE_MANAGED permission model to deploy a standardized VPC baseline to all accounts in an Organizational Unit (OU). Application teams have local administrative access in their member accounts and occasionally modify the VPC resources deployed by the StackSet, causing configuration drift. Leadership wants to guarantee that these baseline resources cannot be modified or deleted by application teams in the first place, rather than detecting and remediating drift after it occurs. Which approach BEST meets this requirement?

Accepted Answer

Attach a Service Control Policy (SCP) to the OU that denies the relevant ec2 modification and deletion actions on the baseline resources for all principals except the StackSet execution role.

Answer

Enable automatic drift detection on the StackSet and configure an EventBridge rule to re-deploy the stack instances whenever drift is reported.

Answer

Add a stack policy to each stack instance that denies Update actions on the VPC resources.

Answer

Set a DeletionPolicy of Retain on the VPC resources and enable stack termination protection on every stack instance.