Which solution will meet this requirement?
Turn on mandatory guardrails in AWS Control Tower. Apply the mandatory guardrails to the production OU.
Enable the appropriate guardrail from the list of strongly recommended guardrails in AWS Control Tower. Apply the guardrail to the production OU.
Use AWS Config to create a new mandatory guardrail. Apply the rule to all accounts in the production OU.
Create a custom SCP in AWS Control Tower. Apply the SCP to the production OU.
Explanations:
Turning on mandatory guardrails in AWS Control Tower does not specifically address the detection of unencrypted Amazon RDS DB instances. It focuses on broader compliance.
Enabling a strongly recommended guardrail that checks for Amazon RDS encryption at rest is appropriate. These guardrails are designed for policy enforcement in Control Tower.
AWS Config can be used to create rules for compliance, but it does not constitute a mandatory guardrail. AWS Control Tower mandatory guardrails are predefined and not custom.
Creating a custom SCP (Service Control Policy) does not specifically enforce encryption checks for RDS instances. SCPs are more about access control than configuration compliance.
As far as I’m aware, the answer is:
Enable the appropriate guardrail from the list of strongly recommended guardrails in AWS Control Tower. Apply the guardrail to the production OU.