Question

A financial services company runs 40 accounts under AWS Organizations. The compliance team wants to enforce a standardized set of ~60 Config rules (mapped to PCI DSS controls) across all existing and future member accounts. Requirements: the rules must be deployed centrally from the management/delegated administrator account, versioned as code in a Git repository, and automatically applied to any newly created account without manual per-account setup. Which approach best meets these requirements?

Accepted Answer

Author a Config conformance pack YAML template stored in Git, then deploy it as an organization conformance pack from the Config delegated administrator account so it applies to all member accounts automatically.

Answer

Create a CloudFormation StackSet with service-managed permissions that provisions the 60 individual Config rules into each account, and manually run drift detection weekly to confirm compliance.

Answer

Enable Security Hub with the PCI DSS standard in every account and rely on its managed controls, exporting the findings config to Git for version tracking.

Answer

Deploy the Config rules in the management account only, and use cross-account IAM roles so the management account's Config recorder evaluates resources in every member account.