Question

A security governance team must continuously evaluate all member accounts in an AWS Organization against a well-defined internal baseline of 40 specific resource configuration rules (e.g., required EBS encryption, mandatory tags, prohibited public RDS instances). They want the entire ruleset deployed and version-controlled as a single, reusable YAML artifact that includes automatic remediation actions, and they want the same package applied uniformly across all accounts via the delegated administrator. Which approach best meets these requirements?

Accepted Answer

Author an AWS Config conformance pack template containing the 40 managed and custom rules plus remediation configurations, and deploy it organization-wide from the Config delegated administrator account.

Answer

Enable the AWS Foundational Security Best Practices standard in Security Hub and rely on its controls to evaluate the 40 rules.

Answer

Create 40 individual AWS Config rules manually in each account and configure SSM Automation remediation per rule.

Answer

Define the 40 rules as a service control policy attached to the organization root to prevent noncompliant resource creation.