Question

A security governance team manages 60 accounts under AWS Control Tower. Leadership requires that no account be able to create publicly accessible RDS instances, and that any existing RDS instance that becomes publicly accessible be automatically detected and reported to a central compliance dashboard. The team wants to minimize ongoing operational overhead while enforcing this at scale. Which combination of controls best satisfies both the preventive and detective requirements?

Accepted Answer

Apply an SCP to the organizational root that denies the RDS API actions when the request sets PubliclyAccessible to true, and deploy a Config conformance pack with the rds-instance-public-access-check rule aggregated into the audit account.

Answer

Deploy a Config rule with an automatic remediation action in each account and rely on Control Tower drift detection to prevent public RDS instances from being created.

Answer

Enable a Security Hub foundational security best practices control in every account and configure GuardDuty to block RDS creation calls that set PubliclyAccessible to true.

Answer

Create an IAM permissions boundary in each account that denies RDS creation with public access, and use CloudTrail Insights to detect any instances that become publicly accessible.