Question

A security team at a large enterprise manages 120 AWS accounts under AWS Organizations. They need to deploy a standardized set of AWS Config rules across all existing and future member accounts to enforce a PCI DSS baseline. The team wants to manage these rules centrally from a dedicated security tooling account (not the management account) and ensure that member account administrators cannot delete or modify the deployed rules. Which approach best meets these requirements with the least ongoing operational effort?

Accepted Answer

Register the security tooling account as a delegated administrator for AWS Config, then deploy an organization conformance pack from that account targeting the entire organization.

Answer

Create a CloudFormation StackSet from the management account that provisions individual AWS Config rules in each member account, and re-run the StackSet manually whenever a new account is added.

Answer

Deploy a conformance pack independently in each member account using a script that assumes a cross-account role, scheduling the script to run daily to catch new accounts.

Answer

Enable AWS Config in the management account only and rely on an SCP that denies config:DeleteConfigRule to protect the rules across the organization.