Question

A security governance team must ensure that every EBS volume across 40 member accounts in an AWS Organization is encrypted, and they want a compliance evaluation to run whenever a volume's configuration changes. They already deploy standard checks through an organization conformance pack. A junior engineer proposes writing a custom AWS Config rule backed by a Lambda function to perform this specific check. Which approach best meets the requirement while minimizing operational overhead and cost?

Accepted Answer

Use the AWS Config managed rule 'encrypted-volumes' deployed via the existing organization conformance pack, triggered on configuration changes.

Answer

Write a custom AWS Config rule backed by a Lambda function in each account and invoke it on a periodic 24-hour schedule.

Answer

Create an EventBridge rule in every account that triggers a Lambda function to scan all EBS volumes hourly and write results to a DynamoDB table.

Answer

Enable Amazon Inspector across all accounts to continuously assess EBS volume encryption status.