QuestionQ13
Security and ComplianceA company uses AWS Organizations to centrally administer its AWS accounts. It enabled AWS Config in every member account by using AWS CloudFormation StackSets. The company configured trusted access in Organizations for AWS Config and designated a member account as the delegated administrator account for AWS Config.
A DevOps engineer must implement a new security policy. The policy must require all existing and future AWS member accounts to use a shared baseline of AWS Config rules, including remediation actions, that is managed from a central account. Non-administrator users with access to member accounts must be unable to modify this shared baseline of AWS Config rules deployed in each member account.
Which solution meets these requirements?
- A Create a CloudFormation template that contains the AWS Config rules and remediation actions. Deploy the template from the Organizations management account by using CloudFormation StackSets.
- B Create an AWS Config conformance pack that contains the AWS Config rules and remediation actions. Deploy the pack from the Organizations management account by using CloudFormation StackSets.
- C Create a CloudFormation template that contains the AWS Config rules and remediation actions. Deploy the template from the delegated administrator account by using AWS Config.
- D Create an AWS Config conformance pack that contains the AWS Config rules and remediation actions. Deploy the pack from the delegated administrator account by using AWS Config.
Community Discussion