Exam AWS Certified SysOps Administrator - Associate topic 1 question 230 discussion

Option A (Use AWS CloudFormation Stack Sets to deploy stack instances that turn on AWS Config in all accounts and in all Regions) is the best option for achieving the goal in a highly efficient and scalable manner. AWS CloudFormation Stack Sets allow you to deploy CloudFormation stacks across multiple accounts and Regions in a single operation. By defining a stack that enables AWS Config and using Stack Sets, you can easily enable AWS Config in all accounts and Regions within the AWS organization. Option B (Use AWS CloudFormation Stack Sets to deploy stack policies that turn on AWS Config in all accounts and in all Regions) is not the correct option. Stack policies are used to control what actions can be performed on a CloudFormation stack, but they are not suitable for enabling AWS Config across multiple accounts and Regions.

many account in multiple regions = stack sets

If you read and understand the following link, there is no question what the answer is (A.) https://aws.amazon.com/blogs/mt/managing-aws-organizations-accounts-using-aws-config-and-aws-cloudformation-stacksets/

A is the correct answer. Stack policies have nothing to do with it. C is clearly irrelevant. Finally, D won’t be as simple.

A. https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-prereq-config.html Stackset policies are not used for this purpose. https://aws.amazon.com/blogs/mt/managing-aws-organizations-accounts-using-aws-config-and-aws-cloudformation stacksets/#:~:text=AWS%20CloudFormation%20StackSets%20helps%20enable,the%20CloudFormation%20console%2C%20choose%20StackSets. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-concepts.html https://aws.amazon.com/blogs/mt/managing-aws-organizations-accounts-using-aws-config-and-aws-cloudformation-stacksets/#:~:text=AWS%20CloudFormation%20StackSets%20helps%20enable,the%20CloudFormation%20console%2C%20choose%20StackSets.

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-concepts.html#stacksets-concepts-stackinstances

I think B is correct, but I'm not 100% sure about if it's policy based on instance based. Reference for CloudFormation: https://aws.amazon.com/blogs/aws/use-cloudformation-stacksets-to-provision-resources-across-multiple-aws-accounts-and-regions/

The answer is A. Correct me if am wrong. https://aws.amazon.com/blogs/mt/managing-aws-organizations-accounts-using-aws-config-and-aws-cloudformation-stacksets/ https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-prereq-config.html