Question

A security engineer must enforce a baseline set of AWS Config rules across all 40 accounts in an AWS Organization. The requirements are: rules must be deployed and maintained centrally from the organization management (or delegated administrator) account, new accounts joining the organization must automatically receive the rules, and any non-compliant S3 buckets that allow public access must be automatically remediated without manual intervention. Which approach best meets ALL of these requirements?

Accepted Answer

Deploy an organization conformance pack from the Config delegated administrator account that includes the managed rules plus a remediation configuration referencing an SSM Automation document.

Answer

Create individual AWS Config rules in each account and use an SCP to deny s3:PutBucketPublicAccessBlock changes that would make buckets public.

Answer

Deploy a CloudFormation StackSet that provisions Config rules in each account, and rely on Security Hub foundational standards to remediate the findings automatically.

Answer

Enable an organization conformance pack, but perform remediation manually through the Security Hub console since conformance packs cannot invoke automatic remediation.