Question

A CloudOps engineer must continuously evaluate whether all EBS volumes, RDS instances, and S3 buckets across every account in an AWS Organization are encrypted at rest. Leadership wants a single, standardized set of encryption compliance rules deployed centrally and applied to all member accounts, with results aggregated for auditors. Which approach best meets these requirements with the least ongoing operational effort?

Accepted Answer

Deploy an AWS Config conformance pack containing the encryption managed rules from the organization management (or delegated administrator) account across the organization, and use a Config aggregator to consolidate compliance results.

Answer

Enable AWS CloudTrail organization trails and write a Lambda function that parses log events to detect resources created without encryption.

Answer

Manually create individual AWS Config rules for encryption in each member account and review each account's Config dashboard separately.

Answer

Attach a Service Control Policy that denies creation of any unencrypted resource, and rely on the SCP denials to report ongoing compliance status.