A company's DevOps team manages a set of AWS accounts that are in an organization in AWS Organizations.
The company needs a solution that ensures that all Amazon EC2 instances use approved AM Is that the DevOps team manages. The solution also must remediate the usage of AMIs that are not approved. The individual account administrators must not be able to remove the restriction to use approved AMIs.
Which solution will meet these requirements?
Enabling AWS Config across the organization and deploying a conformance pack that uses the approved-amis-by-id AWS Config managed rule ensures that all Amazon EC2 instances use only approved AMIs. This approach also includes the ability to automatically remediate noncompliant instances by configuring the rule to run the AWS-StopEC2Instance AWS Systems Manager Automation runbook. By deploying the conformance pack across the organization, it ensures that individual account administrators cannot remove the restriction, fulfilling all requirements.
---> D
A & C. only alert, not automatically remediate noncompliant instances B. deploy via CloudFormation StackSets to individual accounts can still allow account administrators to modify or remove the rules.