Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 321 discussion

SCP will deny the creation of those resources if are not encrypted

The company wants to enforce encryption at resource creation time before a CloudFormation stack operation is allowed. The best way to do that is by using CloudFormation Hooks, which can validate or block stack operations pre-deployment based on custom logic. CloudFormation Hooks allow you to enforce pre-provisioning checks. Hooks can block stack creations or updates that don’t meet compliance (e.g., unencrypted EBS volumes or SQS queues). You can deploy the Hook organization-wide using CloudFormation StackSets with trusted access enabled. This provides automated, consistent enforcement across accounts in an OU.

KEYWORD enforce this policy before a CloudFormation stack operation

• CloudFormation StackSets allows you to deploy a CloudFormation template across multiple AWS accounts and regions in your organization. By enabling trusted access to CloudFormation StackSets, you can manage resources and apply policies uniformly across multiple accounts within the OU. • A CloudFormation Hook is a way to enforce specific policies or checks during stack operations. In this case, you can create a Hook to ensure that all EBS volumes and SQS queues created or updated in the CloudFormation stack have server-side encryption enabled. • The StackSet and Hook can be deployed across all accounts in the specified OU, ensuring that server-side encryption is automatically enforced before any stack operation proceeds, thus satisfying the company’s policy.

The answer is A

CloudFormation Hooks allow you to intercept stack operations and perform validations or enforce policies before resources are created or updated. Develop a CloudFormation Hook that checks whether EBS volumes and SQS queues in the CloudFormation templates have SSE enabled. Use CloudFormation StackSets with trusted access to deploy the Hook across all accounts in the OU. The Hook will validate templates and prevent non-compliant resources from being created or updated during stack operations. Applies only to resources managed via CloudFormation, aligning with the company's requirement. Centralized Deployment: StackSets allow you to deploy the Hook across multiple accounts and regions efficiently. Hooks do not interfere with non-CloudFormation operations, limiting the scope to what's required.