Use a CloudFormation hook enforcing encryption and deploy it across the OU with StackSets trusted access

Why the Answer Is Correct

The requirement is explicit that the policy be enforced before a CloudFormation stack operation, which places the control inside the CloudFormation operation lifecycle. A CloudFormation hook is the mechanism designed for this: it is invoked during stack operations and can perform validations that fail the operation before resources are created or updated, so a stack that would create an EBS volume or an SQS queue without server-side encryption is blocked rather than created and flagged afterwards (A). tubtab highlighted exactly this keyword, that the policy must be enforced before the stack operation. To apply that enforcement across every account in the organizational unit, trusted access for CloudFormation StackSets is activated and the hook is deployed to the accounts in the OU using StackSets, which distributes the same enforcement uniformly without manual per-account work (A). Ky_24 described the StackSets distribution model and f4b18ba explained that hooks intercept stack operations to validate or enforce policy before resources are created or updated. A is the correct answer.

Why the Other Options Are Wrong

B sets up AWS Config in the accounts of the OU and uses Systems Manager to deploy Config rules enforcing server-side encryption. AWS Config evaluates resource configuration after it exists, so a noncompliant EBS volume or SQS queue would already have been created by the time the rule reports it; this is detection rather than prevention and does not satisfy the requirement to enforce the policy before the stack operation proceeds. C writes an SCP denying the creation of EBS volumes and SQS queues unless they have server-side encryption. An SCP evaluates AWS API authorization and cannot inspect whether a CloudFormation template supplies an encryption setting, so in practice it would deny the creation of these resources outright rather than validating the template, which would make compliant deployments impossible as well as failing the before-the-operation intent. D creates a Lambda function in the delegated administrator account that checks whether server-side encryption is enforced, along with an IAM role giving it access to the accounts in the OU. This is an out-of-band inspection mechanism that runs independently of CloudFormation, so it cannot enforce anything at the moment a stack operation is submitted; it can only report afterwards. A is correct.

Community Comment Notes

Community voted A unanimously. Srikantha identified the decisive reasoning, that the company wants enforcement at resource creation time before a CloudFormation stack operation is allowed, and that CloudFormation hooks can validate or block the operation. tubtab named the keyword enforce this policy before a CloudFormation stack operation. Ky_24 explained that activating trusted access for StackSets and using StackSets distributes the hook across the accounts in the OU. f4b18ba explained that CloudFormation hooks intercept stack operations and perform validations or enforce policies before resources are created or updated, and separately noted elsewhere that detection-based options such as AWS Config and Lambda checks do not prevent the stack operation. No alternative received support.