How can you implement policy-as-code to maintain guardrails across multiple accounts?

• A. Use a combination of AWS Config rules, guardrails via SCPs, and IaC pipelines (CloudFormation/CDK) to codify and enforce policies
• B. Use a single centralized IAM role with permissions for all accounts
• C. Manually audit each account monthly and adjust permissions
• D. Use S3 bucket policies to enforce cross-account access

Answer: (C)

Policy as code across multiple accounts is best achieved by codifying guardrails and enforcing them automatically at the organization level. Using a combination of AWS Config rules to continuously evaluate resource configurations, guardrails realized as Service Control Policies (SCPs) to restrict actions across accounts, and infrastructure-as-code pipelines (such as CloudFormation or CDK deployed through CI/CD) to version, test, and deploy policy changes provides automated, scalable, and auditable governance. This setup ensures that, no matter which account a user or service operates in, the intended policies are consistently enforced, drift is detected and remediated, and policy updates are traceable and repeatable.

Relying on a single centralized IAM role, manually auditing each account, or configuring only asset-specific policies like S3 buckets does not deliver scalable, enforceable, organization-wide guardrails. A centralized role still relies on ad hoc permissions, manual audits are slow and error-prone, and bucket policies alone don’t provide broad, enforceable governance across accounts.