Question

A DevOps engineer manages compliance for an organization with 60 accounts in AWS Organizations. The security team wants a single AWS Config rule that checks whether all EBS volumes are encrypted, deployed consistently across every existing and future member account, with results visible centrally. They do not want to manually create or maintain the rule in each account, and they want the security account (not the management account) to own the deployment. What is the MOST operationally efficient approach?

Accepted Answer

Register the security account as a delegated administrator for AWS Config, then create an organization Config rule (PutOrganizationConfigRule) using the encrypted-volumes managed rule so it is deployed to all member accounts automatically.

Answer

Use a CloudFormation StackSet with service-managed permissions from the management account to deploy an identical Config rule into each member account and enable automatic deployment for new accounts.

Answer

Create the Config rule in the security account and share it with member accounts using AWS Resource Access Manager (RAM), enabling automatic propagation to new accounts.

Answer

Deploy a Config conformance pack from the management account containing the encrypted-volumes rule, and rely on each account owner to accept the conformance pack invitation.