Which solution will meet these requirements in the MOST operationally efficient way?
Create an AWS CloudFormation template that defines the standard account resources. Deploy the template to all accounts from the organization’s management account by using CloudFormation StackSets. Set the stack policy to deny Update Delete actions.
Enable AWS Control Tower. Enroll the existing accounts in AWS Control Tower. Grant the individual account administrators access to CloudTrail and AWS Config.
Designate an AWS Config management account. Create AWS Config recorders in all accounts by using AWS CloudFormation StackSets. Deploy AWS Config rules to the organization by using the AWS Config management account. Create a CloudTrail organization trail in the organization’s management account. Deny modification or deletion of the AWS Config recorders by using an SCP.
Create an AWS CloudFormation template that defines the standard account resources. Deploy the template to all accounts from the organization’s management account by using CloudFormation StackSets. Create an SCP that prevents updates or deletions to CloudTrail resources or AWS Config resources unless the principal is an administrator of the organization’s management account.
Explanations:
While CloudFormation StackSets can be used to deploy resources, using a stack policy to deny updates or deletions would not allow account administrators to manage their own CloudTrail trails and AWS Config rules. This does not fully satisfy the requirement that individual account administrators can edit or delete their own CloudTrail and AWS Config resources.
AWS Control Tower can provide governance, but it doesn’t fully address the requirement of preventing administrators from modifying baseline resources, such as CloudTrail and AWS Config, across accounts. Additionally, Control Tower alone doesn’t provide the fine-grained control required for restricting modifications only to certain resources.
This option requires creating a management account for AWS Config, and while it proposes using an AWS Config management account and SCP to prevent deletion of AWS Config recorders, it doesn’t fully handle the CloudTrail resources. The individual administrators would also not be able to modify CloudTrail as required.
This solution uses AWS CloudFormation StackSets to deploy standard resources to all accounts and uses an SCP to prevent modifications or deletions of CloudTrail and AWS Config resources unless the principal is an administrator of the organization’s management account. This meets all the requirements, including allowing individual administrators to manage their own CloudTrail and AWS Config rules.
My best guess is:
Create an AWS CloudFormation template that defines the standard account resources. Deploy the template to all accounts from the organization’s management account by using CloudFormation StackSets. Create an SCP that prevents updates or deletions to CloudTrail resources or AWS Config resources unless the principal is an administrator of the organization’s management account.