AWS Certified Solutions Architect Professional SAP-C02 Practice Question

The correct approach is to use AWS CloudFormation StackSets with service-managed permissions. CloudFormation StackSets are designed to deploy stacks across multiple AWS accounts and Regions in a single operation. When used with service-managed permissions in an AWS Organization, you can target entire OUs. This solution allows for automatic deployment to new accounts added to the target OUs, fulfilling a key requirement. Furthermore, StackSets have a built-in drift detection feature, which allows you to identify resources that have been altered outside of CloudFormation, thus detecting deviations from the standard baseline.

Incorrect options are:

• Deploying individual CloudFormation templates via a CI/CD pipeline is less scalable. It lacks the centralized management of StackSets and does not automatically handle the onboarding of new accounts; a manual process would be needed to trigger the pipeline for each new account.
• Using an AWS Lambda function with the AWS SDK to create and manage the buckets is an imperative, custom-coded solution. This approach is more complex to build and maintain than a declarative IaC solution like CloudFormation. It would require custom logic for state management, idempotency, and drift checking, all of which are native features of CloudFormation StackSets.
• Using only AWS Config with remediation actions is a reactive approach focused on compliance and governance, not initial resource provisioning. While it can detect and fix non-compliant resources, it does not handle the initial, standardized deployment of the S3 buckets across the organization. The primary goal is to provision resources, which is the main function of CloudFormation.