AWS Certified Advanced Networking – Specialty (ANS-C01)Network Management and OperationsMedium
A company uses AWS Organizations to manage multiple AWS accounts. They need to ensure that all VPCs across all member accounts have consistent and compliant network configurations, such as specific security group rules, network ACLs, and routing policies. Manual configuration is prone to errors and does not scale. Which approach should the company use to automate and enforce these configurations?
- ALeverage AWS Systems Manager Distributor to deploy configuration agents to EC2 instances.
- BDevelop custom scripts to apply configurations using the AWS CLI and run them periodically.
- CImplement AWS Config rules to detect non-compliant resources and manually remediate them.
- DUse AWS CloudFormation StackSets to deploy and manage network resources across accounts and Regions.
Show answer & explanationAnswer & explanation
Correct answer: D. Use AWS CloudFormation StackSets to deploy and manage network resources across accounts and Regions.
AWS CloudFormation StackSets allow you to deploy and manage CloudFormation stacks across multiple AWS accounts and Regions from a single CloudFormation template. This is the ideal solution for ensuring consistent and compliant network configurations across an AWS Organization, as it automates deployment and provides a centralized way to manage changes.
Why the other options are wrong
- A. Systems Manager Distributor is for deploying software packages and agents to EC2 instances, not for managing VPC-level network configurations across accounts.
- B. Custom scripts are prone to errors, difficult to maintain, and lack the declarative nature and compliance enforcement of CloudFormation StackSets.
- C. AWS Config rules can detect non-compliance but require manual remediation or separate automation to enforce, which is less efficient than proactive deployment with StackSets.
CloudFormation StackSets
An extension of AWS CloudFormation that enables you to provision, update, or delete stacks across multiple AWS accounts and Regions with a single operation.
- Ensures consistent resource deployment across an AWS Organization.
- Manages infrastructure as code (IaC) at scale.
- Supports automatic deployment to new accounts added to an Organization.
Memory trick: For 'consistent' 'stacks' across 'sets' of accounts, use 'StackSets'.