Question

A security team must deploy a standardized set of AWS Config rules across all 120 accounts in their AWS Organization to enforce a PCI DSS baseline. Requirements: the deployment must automatically apply to newly created accounts, the security team (not the management account) must own and operate the deployment from a dedicated security account, and any account owner must be prevented from deleting the deployed rules. Which approach best meets ALL requirements?

Accepted Answer

Register the security account as the delegated administrator for AWS Config, then deploy an organization conformance pack scoped to the entire organization.

Answer

From the management account, use CloudFormation StackSets with service-managed permissions and automatic deployment enabled to push individual Config rules to every account.

Answer

Have each account owner manually enable a conformance pack from a shared S3 template and use an SCP to deny config:DeleteConfigRule.

Answer

Deploy a Security Hub PCI DSS standard from the delegated administrator account and rely on its underlying Config rules for enforcement.