A company has an organization in AWS Organizations with many Oils that contain many AWS accounts. The organization has a dedicated delegated administrator AWS account. The company needs the accounts i

Question

Options

• AActivate trusted access to CloudFormation StackSets. Create a CloudFormation Hook that
• BSet up AWS Config in all the accounts in the OU. Use AWS Systems Manager to deploy AWS
• CWrite an SCP to deny the creation of EBS volumes and SQS queues unless the EBS volumes
• DCreate an AWS Lambda function in the delegated administrator account that checks whether

• A
  62% (16)
• B
  4% (1)
• C
  12% (3)
• D
  23% (6)

Explanation

Trusted access enables the AWS CloudFormation service to operate in a delegated administrator account and manage resources across all accounts in the OU, ensuring centralized control with minimal manual intervention. CloudFormation StackSets are designed to deploy CloudFormation templates across multiple AWS accounts and regions within an organization. By deploying the CloudFormation Hook across the accounts in the OU using StackSets, you ensure that the policy is enforced consistently across all relevant accounts in the OU. CloudFormation Hooks allow you to enforce specific constraints and best practices on CloudFormation stack operations before resources are created or updated. By creating a Hook that specifically enforces server-side encryption on EBS volumes and SQS queues, you can ensure that every CloudFormation stack operation in the accounts of the OU complies with the encryption requirement. This solution provides pre-emptive enforcement of encryption policies, preventing non-compliant resources from being created or updated. It also integrates with existing AWS management and governance services, providing a scalable and automated way to enforce compliance across multiple accounts in the organization.

No community discussion yet for this question.