SCS-C02 Question 462
Single answerYour organization manages multiple AWS accounts under a single AWS Organization. You are tasked with ensuring a consistent and secure deployment of AWS Config rules across all accounts and regions to monitor compliance. Additionally, you need to track the versions of these configurations to ensure they are kept up-to-date. Which approach should you use to achieve this?
- A
Use AWS CloudFormation StackSets to centrally deploy and manage AWS Config rules across all accounts and regions.
- B
Use AWS Systems Manager Parameter Store to store and deploy configuration templates for AWS Config rules.
- C
Manually deploy AWS Config rules in each account and region, and track changes using an internal version control system.
- D
Use AWS Control Tower to automatically deploy AWS Config rules across all accounts and regions, and manage versions.
Show answer and explanation
Correct answer: A
Explanation
AWS CloudFormation StackSets is the most suitable solution for this scenario as it enables centralized management, deployment, and versioning of AWS Config rules across multiple accounts and regions. It ensures consistency, simplifies updates, and is designed for multi-account, multi-region deployments, making it ideal for compliance monitoring in an AWS Organization.
- A. Correct.
This is the correct answer. AWS CloudFormation StackSets allow centralized deployment of AWS Config rules across multiple accounts and regions under an organization. It also supports versioning through template updates.
- B. Incorrect.
AWS Systems Manager Parameter Store is used for storing configuration data, but it does not provide centralized deployment or versioning capabilities for AWS Config rules.
- C. Incorrect.
Manually deploying AWS Config rules is error-prone and inefficient for large-scale environments. Additionally, using an internal version control system does not integrate with AWS services for versioning.
- D. Incorrect.
While AWS Control Tower helps set up and govern multi-account environments, it does not natively support centralized deployment or versioning of AWS Config rules.