A 40-person platform team manages 30 AWS accounts with repeatable VPCs and needs reviewable infrastructure changes, reusable networking constructs in TypeScript, and drift-safe deployments through pipelines. Which infrastructure-as-code approach combining declarative and imperative paradigms best meets the standardization need?
Select an answer to reveal the explanation.
Short Explanation
You're moving from handwritten notes to blueprints plus power tools. Composability with CDK over CloudFormation lets you reuse tested VPC code while keeping every change reviewable.
Full Explanation
The scenario demands declarative compliance baselines plus imperative reuse in TypeScript with reviewable pipeline delivery across many accounts, which the correct pairing satisfies because CloudFormation provides version-controlled declarative VPC definitions that enable diff review and drift detection while CDK compiles TypeScript classes into those templates for true object-oriented reuse, and running both through pipelines adds approvals and repeatable multi-account rollout for standardization. The Terraform-based pipeline approach fails the language constraint by concept because modules written in HCL syntax cannot satisfy the explicit TypeScript reusable construct requirement despite offering excellent plan review and consistency. The workstation CDK approach fails the delivery constraint by concept because direct local synthesis and deployment bypasses versioned review, approval gates, and drift-safe pipeline execution required for a large team managing thirty accounts. The centralized template with StackSets approach fails the paradigm constraint by concept because pure JSON or YAML templates distributed centrally provide declarative compliance but lack the imperative TypeScript abstraction needed for reusable networking constructs. An exam caveat is to read for exact language and delivery cues rather than assuming any pipeline-capable IaC tool is interchangeable when TypeScript and combined paradigms are stated. A practical check is to verify repository pull-request history for template diffs, CDK construct library versioning, and pipeline execution logs showing drift detection across accounts before approving standardization.