A regulated company runs workloads across 40 member accounts in AWS Organizations and must continuously check that every account satisfies the same set of CIS benchmark controls. The compliance team wants one place to deploy the rule set, have it apply automatically to any new account that joins, and view a single aggregated compliance status. They want to avoid maintaining copies of the rules in each account. Which approach meets these requirements with the least ongoing administration?
- AUse an AWS CloudFormation StackSet to deploy individual AWS Config managed rules into each member account and re-run the StackSet manually whenever the organisation onboards a new member account that needs the controls.
- BEnable AWS Security Hub in one account and rely on its CIS standard there, asking each member-account team to review their own findings separately in their own Security Hub console whenever an audit is requested.
- CDeploy an AWS Config conformance pack as an organisation conformance pack from the delegated administrator account so it applies to all current and future member accounts, then view results through the organisation aggregator. Correct
- DWrite an AWS Lambda function that calls the AWS Config API in each account on a schedule, evaluates the CIS controls in custom code, and writes a combined compliance summary to a central Amazon S3 bucket for the team.
Why A is wrong: A StackSet of per-account rules is tempting because it does push config to many accounts, but it requires re-running on each new account and leaves the rule set duplicated everywhere, which fails the auto-enrol and no-copies requirements.
Why B is wrong: Security Hub does run CIS checks, but enabling it in only one account leaves the other accounts unevaluated and forces per-account manual review, so it neither aggregates organisation-wide status nor auto-enrols new accounts.
Why C is correct: An organisation conformance pack deployed from the delegated administrator is provisioned once, automatically reaches every current and future member account, and its results roll up through an organisation aggregator, meeting the central-deploy and auto-enrol requirements with minimal administration.
Why D is wrong: A hand-built Lambda evaluator can technically read each account, but it duplicates logic AWS Config already provides, needs cross-account credentials and ongoing maintenance, and is far more operational overhead than an organisation conformance pack.