Question

A financial services company runs 220 AWS accounts under AWS Organizations. The security governance team wants a single, repeatable way to continuously evaluate accounts against the PCI DSS requirement set, generate compliance reports for auditors, and automatically remediate a specific violation (public S3 buckets) across all accounts. They want to minimize per-account manual setup and centralize the evaluation logic. Which approach best meets these requirements?

Accepted Answer

Deploy a Config conformance pack (using a PCI-aligned sample template with an embedded SSM Automation remediation for S3 public access) from the Config delegated administrator account across the organization.

Answer

Enable the Security Hub PCI DSS standard in every account individually and rely on its findings to trigger manual remediation by each account owner.

Answer

Create individual AWS Config rules in each account with separate remediation actions, and manually copy the rule definitions to new accounts as they are onboarded.

Answer

Author a single SCP in AWS Organizations that denies creation of public S3 buckets and produces a compliance report through Organizations.