A platform team manages 80 AWS accounts with CloudFormation and CDK, but developers repeatedly deploy non-encrypted S3 buckets and oversized EC2 types, with drift detected weeks later. Leadership wants violations blocked before deploy plus auto-remediation. Which policy-as-code design provides proactive validation, enforcement, and drift remediation?
Select an answer to reveal the explanation.
Short Explanation
You’ll catch mistakes at the door instead of chasing them for weeks afterward. That shift-left shield relies on proactive controls that block, remind, and auto-fix without slowing builders.
Full Explanation
The correct design is the only one that covers the full policy lifecycle across 80 accounts: CloudFormation Hooks provide native pre-deploy enforcement that fails non-compliant CREATE and UPDATE operations, CDK aspects apply the same encryption and instance-type logic at synthesis for developer feedback, AWS Config rules provide continuous detective evaluation to catch drift weeks after deployment, Systems Manager remediation paired with Config enables auto-remediation, and Service Control Policies supply non-bypassable organization guardrails. The organization-wide Config with auto-remediation approach is a standard detective pattern but fails on proactivity because evaluation occurs after provisioning, so unencrypted buckets are briefly exposed and blocked-before-deploy is not met. The CI-integrated cfn-guard with CDK aspects approach is a strong shift-left preventive pattern but fails on continuous governance because it cannot detect or auto-remediate configuration drift or out-of-band changes once resources exist. The Service Catalog with StackSets approach is a widely used standardization pattern but fails on remediation because catalog constraint plus periodic drift detection only reports variance without automatically reverting unencrypted buckets or resizing instances, and direct stack deployments can bypass it. For exam precision, carefully separate preventive controls that block, detective controls that alert, and remediation controls that fix, since prompts demanding all three require a combined architecture. As a practical check, verify Hook failure modes are set to FAIL, test Config-to-remediation IAM permissions in a sandbox account, and confirm SCPs do not break break-glass or pipeline deployment roles before organization-wide rollout.