Automatically Apply Baseline Security Controls to New AWS Accounts
A company wants to implement a multi-account strategy using AWS Organizations. The security team requires that all new accounts added to the organization automatically inherit a baseline set of security controls, such as AWS CloudTrail and AWS Config rules. Which approach should the company use?
Quick Answer
The correct approach is to use AWS CloudFormation StackSets to automatically apply baseline security controls to new AWS accounts. This works because StackSets enable you to deploy identical CloudFormation stacks across multiple accounts and regions from a single template, and when integrated with AWS Organizations, they can be configured to automatically deploy to new accounts as they are added. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this question tests your understanding of the distinction between governance tools: Service Control Policies (SCPs) only restrict permissions and cannot deploy resources, while StackSets are the proper mechanism for automated resource deployment. A common trap is confusing SCPs with resource deployment—remember that SCPs are like guardrails, not construction crews. For your memory tip: think "StackSets stack resources, SCPs stack restrictions."
⚠ Common exam trap
It's easy for candidates to confuse SCPs (which only restrict permissions) with actual resource deployment mechanisms, leading candidates to incorrectly choose Option A because they think SCPs can 'enforce' the presence of services like CloudTrail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS CloudFormation StackSets to deploy the baseline stack to new accounts automatically.
AWS CloudFormation StackSets can automatically deploy a common baseline stack (containing CloudTrail, AWS Config rules, and other security controls) to all accounts in an AWS Organization, including new accounts as they are added. This approach ensures consistent, automated deployment of infrastructure-as-code across the entire organization without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Organizations Service Control Policies (SCPs) to enforce the baseline controls.
Why it's wrong here
SCPs define permission guardrails on IAM principals; they cannot create CloudTrail trails or Config rules. SCPs are correct when you must deny actions such as disabling CloudTrail across accounts, but the stem requires the baseline resources to be provisioned automatically, which guardrails alone cannot achieve.
- ✗
Use AWS Systems Manager Automation to apply the baseline to new accounts.
Why it's wrong here
Systems Manager Automation runs remediation runbooks inside accounts you target; it does not push controls into newly created accounts automatically. It is tempting because Automation is the right tool for scheduled or event-driven operational tasks within existing accounts, such as patching or config drift remediation, but it lacks the organisation-wide inheritance mechanism this scenario needs.
- ✓
Use AWS CloudFormation StackSets to deploy the baseline stack to new accounts automatically.
Why this is correct
CloudFormation StackSets with service-managed permissions deploy stacks automatically to accounts as AWS Organizations adds them, satisfying the requirement that new accounts inherit baseline controls without manual intervention. Unlike account-creation triggers or Control Tower, StackSets directly targets the organisational unit, ensuring CloudTrail and Config rules land immediately on joining.
- ✗
Use AWS Config aggregators to apply the baseline controls to new accounts.
Why it's wrong here
Config aggregators only collect and centralise configuration and compliance data from source accounts; they cannot deploy CloudTrail or Config rules. Aggregators are the correct choice when you need a cross-account, read-only compliance dashboard, but here the requirement is automatic provisioning of controls into each new account, which aggregators never perform.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 984-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A multinational company is implementing a multi-account strategy using AWS Organizations. The security team needs to ensure that all newly created accounts automatically have a specific baseline CloudTrail trail and a set of AWS Config rules applied. The company also wants to enforce that no account can disable these controls. Which solution should be used?
hard- ✓ A.Create an SCP that denies actions to disable CloudTrail and AWS Config, and use AWS CloudFormation StackSets to deploy the baseline resources to all accounts in the organization.
- B.Use IAM roles with a trust policy that allows the management account to deploy CloudTrail and AWS Config, and use AWS Lambda to monitor for changes.
- C.Use AWS Control Tower to set up the baseline and enforce it via preventive guardrails.
- D.Use AWS Organizations to create an SCP that deploys AWS Config rules and CloudTrail via AWS CloudFormation StackSets.
Why A: It combines an SCP that denies actions to disable CloudTrail and AWS Config (e.g., `cloudtrail:StopLogging`, `config:DeleteConfigRule`) with AWS CloudFormation StackSets to deploy the baseline resources across all accounts in the organization. The SCP enforces that no account (including root users) can disable the controls, while StackSets automatically deploy the CloudTrail trail and Config rules to new accounts as they join the organization. This meets both the automatic deployment and enforcement requirements.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.