A regulated insurer deploys CloudFormation and CDK across 50 accounts and must block non-encrypted S3 buckets before deployment, flag violations in pipelines, and auto-remediate drift after deployment. Which policy-as-code design provides proactive validation, enforcement, and drift remediation?
Select an answer to reveal the explanation.
Short Explanation
You get the full control loop by pairing CDK synthesis checks with deployment-time denial and post-deployment repair. Shift-left validation flags bad templates early, while Config remediation fixes drift afterward.
Full Explanation
The design with CloudFormation Hooks set to deny, CDK aspects for synthesis checks, and AWS Config remediation covers the full lifecycle: Hooks block non-compliant templates at deployment, CDK aspects flag violations in the pipeline before deployment, and Config detects and repairs encryption drift afterward across the 50-account estate. Using Hooks to deny with cdk-nag pipeline checks but Config rules that only alert leaves detected drift uncorrected, so it misses the required auto-remediation. Using Hooks in warn mode with CDK pipeline checks and Config auto-remediation provides early flagging and drift repair, but warn mode allows an unencrypted bucket to deploy, violating the blocking requirement. Using Hooks to deny with Config auto-remediation and centralized CloudTrail auditing blocks and repairs violations, but lacks CDK synthesis checks to flag them in the pipeline. Exam caveat: distinguish alerting from remediation, and warn mode from denial; a control that reports a violation does not necessarily block it or fix it. Practical check: in a sandbox, synthesize an unencrypted bucket and confirm the pipeline flags it, attempt deployment and confirm the Hook denies it, then remove encryption from a deployed bucket and confirm Config restores it.