QuestionQ13

Security and Compliance

A company uses AWS Organizations to centrally administer its AWS accounts. It enabled AWS Config in every member account by using AWS CloudFormation StackSets. The company configured trusted access in Organizations for AWS Config and designated a member account as the delegated administrator account for AWS Config.

A DevOps engineer must implement a new security policy. The policy must require all existing and future AWS member accounts to use a shared baseline of AWS Config rules, including remediation actions, that is managed from a central account. Non-administrator users with access to member accounts must be unable to modify this shared baseline of AWS Config rules deployed in each member account.

Which solution meets these requirements?

  • A Create a CloudFormation template that contains the AWS Config rules and remediation actions. Deploy the template from the Organizations management account by using CloudFormation StackSets.
  • B Create an AWS Config conformance pack that contains the AWS Config rules and remediation actions. Deploy the pack from the Organizations management account by using CloudFormation StackSets.
  • C Create a CloudFormation template that contains the AWS Config rules and remediation actions. Deploy the template from the delegated administrator account by using AWS Config.
  • D Create an AWS Config conformance pack that contains the AWS Config rules and remediation actions. Deploy the pack from the delegated administrator account by using AWS Config.
Explanation

An AWS Config organization conformance pack is a centrally managed collection of AWS Config rules and remediation actions that can be deployed across an AWS Organization, including to future member accounts. A management account or AWS Config delegated administrator can deploy it. AWS Config creates the rules and remediation configurations in member accounts through its service-linked role, so member-account users do not need—and need not receive—the permissions that manage the centrally deployed baseline.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!