Deploying CDK Security Controls Across AWS Accounts

DOP-C02 By islever Editorial Last updated

Deploy automation to create, onboard, and secure AWS accounts in a multi-account or multi-Region environment.

Short answer

D Use AWS Control Tower to create a customized landing zone that includes configurations from the security controls construct.

Question

A company manages its multi-account environment by using AWS Organizations and AWS Control Tower. The company must deploy standardized security controls and compliance policies across all of its AWS accounts and AWS Regions. Any changes to these controls must be automatically applied to all accounts simultaneously.
The company has the required security controls and compliance policies defined in AWS Cloud Development Kit (AWS CDK) as a security controls construct.
Which solution will deploy these controls across all accounts and Regions with the LEAST operational overhead?
  1. Create an AWS CDK app that includes an AWS CloudFormation StackSets construct. Configure the StackSets construct to use the security controls construct as its template. Specify the target accounts and Regions. Create automation to deploy the CDK app to create and manage the CloudFormation stack set.
  2. Create an AWS CDK app that synthesizes an AWS CloudFormation template from the security controls construct. Use Amazon EventBridge to invoke an AWS Lambda function to update a CloudFormation stack set when changes are made to the security controls construct.
  3. Convert the security controls construct to an AWS CloudFormation macro. Create a CloudFormation stack set that references the macro and deploys the macro to all target accounts. Use Organizations to automatically add new accounts to the stack set’s list of target accounts.
  4. Use AWS Control Tower to create a customized landing zone that includes configurations from the security controls construct. Configure AWS Control Tower to automatically enroll new accounts and to apply the landing zone template. Correct Answer

Key Takeaways

The key is recognizing that AWS Control Tower's Landing Zone customization feature provides the least operational overhead for applying centralized policies, even when those policies are defined in CDK.

This question evaluates the ability to deploy standardized security controls across a multi-account AWS environment using AWS Control Tower and CloudFormation Customizations.

Common mistake: Many candidates choose Option A (CloudFormation StackSets) because it directly uses CDK, but this requires manual or custom automation to manage deployments, violating the 'least operational overhead' constraint.

Expert Analysis

Why the Answer Is Correct

Option D is correct because AWS Control Tower is specifically designed to establish and maintain secure, compliant multi-account environments with minimal management effort. The question states that security controls are already defined as an AWS CDK construct; AWS Control Tower supports 'Customizations' which allow you to use CloudFormation templates (synthesized from your CDK code) to apply configurations to accounts automatically. By creating a customized landing zone, new accounts are automatically enrolled and the template is applied, satisfying the requirement for simultaneous updates across all accounts and regions with the least operational overhead.

Why the Other Options Are Wrong

Option A involves creating custom automation to deploy CloudFormation StackSets. While technically feasible, managing the deployment pipeline and handling errors manually or via scripts introduces significant operational overhead compared to Control Tower's native automation. Option B adds unnecessary complexity by introducing EventBridge and Lambda to trigger updates, which is more complex than direct integration. Option C suggests using CloudFormation Macros, which are deprecated or limited in scope for cross-account governance and do not offer the automated enrollment and policy enforcement capabilities of Control Tower.

Community Comment Notes

Community consensus strongly favors Option D, noting that Control Tower is purpose-built for standardizing security across organizations. As noted by user saqlain77us, Control Tower enforces guardrails with minimal tooling work. User ccieman2016 highlighted that managing custom automation for StackSets introduces unnecessary complexity compared to leveraging native landing zone customization. Several users pointed out that while CDK is used to define the controls, the deployment mechanism must be the most efficient, which is Control Tower's strength.

Exam Strategy

When a question mentions 'multi-account', 'standardized security controls', and 'least operational overhead', always consider AWS Control Tower first. It is the managed service designed exactly for this scenario.

Frequently Asked Questions

Why isn't CloudFormation StackSets the best choice here?

StackSets require manual or custom automation to manage deployments and drift correction, increasing operational overhead compared to Control Tower's native automation.

How does CDK integrate with AWS Control Tower?

You synthesize your CDK app into a CloudFormation template and use it in Control Tower's Customizations feature to apply configurations to accounts automatically.

More DOP-C02 FAQ →

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. BelloMio 👍 4 Answered A
    Controls are already in CDK. Least operational overhead. Answer is A
  2. TuMMM 👍 2 Answered D
    Control Tower is purpose-built for standardizing security and compliance across organizations. It automatically enrolls new accounts and applies policies. Customizations can be deployed via CFCT, which integrates with CDK constructs. This requires minimal ongoing management.
  3. saqlain77us 👍 2 Answered D
    Control Tower is designed to centrally enforce and propagate standardized guardrails, policies, and landing-zone configurations across all accounts and Regions with minimal tooling work.
  4. 4145ad0 👍 2
    Youre wrong, controls are defined in CDK already.
  5. ccieman2016 👍 1 Answered D
    Correct is D. While AWS CDK (Letter A) supports StackSets constructs, managing custom automation (e.g., pipelines or scripts) to trigger and maintain CloudFormation StackSet deployments across all accounts and Regions introduces unnecessary operational complexity compared to leveraging AWS Control Tower's native landing zone customization capabilities.
Show 1 more comment
  1. grekh001 👍 1
    They may exist in CDK already, but there is no way that "Create automation to deploy the CDK app to create and manage the CloudFormation stack set." Is "LEAST" operational overhead.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Optimizing Amazon Timestream Query Performance

S-grade

Deploy the CloudWatch agent as a StatefulSet with IRSA and CloudWatchAgentServerPolicy, and configure the OIDC provider

S-grade

Disable cross-zone load balancing on the target group and start an Application Recovery Controller zonal shift

S-grade

Stream all CloudWatch metrics to Firehose, transform with Lambda, and deliver to S3

S-grade

Practice All DOP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full DOP-C02 Practice Test →

← Back to DOP-C02 Study Guide