Question

A company operates 45 accounts under AWS Organizations. The security team must continuously verify that all accounts comply with a set of standardized rules (encrypted EBS volumes, no public S3 buckets, mandatory tags), and automatically remediate violations without manually configuring each account. They want compliance findings aggregated in a central account and the ability to deploy new rules once and have them apply everywhere, including future accounts. Which approach best meets these requirements with the least ongoing operational effort?

Accepted Answer

Deploy AWS Config conformance packs from a delegated administrator account using organization-wide deployment, include SSM automation documents as remediation actions, and enable Config aggregators in the central account.

Answer

Write custom Lambda functions in each account triggered by CloudTrail events to detect and remediate non-compliant resources, and forward results to a central SQS queue.

Answer

Use Security Hub with the AWS Foundational Security Best Practices standard in each account and manually build EventBridge rules per account to trigger remediation.

Answer

Create a StackSet that deploys individual AWS Config managed rules to each account and use a scheduled Lambda in the management account to poll compliance status and remediate.