Question

A company uses an AWS Organizations organization to manage multiple AWS accounts across multiple OUs. The company plans to implement a comprehensive account-management solution and needs consistent baseline configurations. A DevOps engineer is developing a solution that automatically deploys AWS CloudFormation templates to new AWS accounts. The particular CloudFormation template deployed must differ according to the organizational unit (OU) into which each new account is placed. Which solution meets these requirements with the **LEAST** operational overhead?

Accepted Answer

A. Enable AWS Control Tower. Use Customizations for AWS Control Tower (CfCT) to deploy each CloudFormation template from a centralized account. Create a CodeCommit repository to store the entire configuration package, including the CloudFormation templates and a manifest file that maps each CloudFormation template to its corresponding OU.

Answer

Enable AWS Control Tower. Build a pipeline in AWS CodePipeline to deploy the CloudFormation deployment from a centralized account. Create a CodeCommit repository to store the entire configuration package, including the CloudFormation templates and a manifest file that maps each CloudFormation template to its corresponding OU. After the code is updated in CodeCommit, initiate the pipeline and deploy the CloudFormation templates to the new AWS accounts.

Answer

Store the CloudFormation templates in an Amazon S3 bucket by using a separate prefix for each AWS account. Create an AWS Lambda function that deploys a specific CloudFormation template to each new AWS account based on the prefix path that indicates where each template is located in the S3 bucket.

Answer

Store CloudFormation templates in an Amazon S3 bucket. Create an AWS Lambda function that deploys a specific CloudFormation template to the new AWS accounts based on the OU each new account is in. Create an Amazon EventBridge rule that matches "eventName": "CreateAccountResult" and "state": "SUCCEEDED." Set the Lambda function as the target of the EventBridge rule.