A company needs a solution to manage AWS WAF rules across multiple AWS accounts organized in different OUs. Administrators must be able to add or remove accounts or OUs from managed WAF rule sets and automatically update/remediate noncompliant WAF rules across all accounts with minimal operational overhead. Which solution meets these requirements?

The correct solution leverages AWS Firewall Manager, designed specifically for centralized management of WAF rules across an AWS Organization, including OUs. Storing account/OU information in Systems Manager Parameter Store provides a scalable and manageable way to define targets. EventBridge and Lambda automate the process of updating Firewall Manager policies when these targets change, ensuring minimal operational overhead and automatic remediation. Incorrect options: AWS Config rules can detect non-compliance but are not designed for direct, centralized deployment and management of WAF rules across an organization like Firewall Manager. CloudFormation StackSets deploy resources but lack the dynamic policy enforcement and remediation capabilities of Firewall Manager. Using Lambda with cross-account roles to manage WAF rules directly is a manual and less scalable approach compared to Firewall Manager, requiring custom logic for policy enforcement and remediation. Lambda environment variables are not ideal for storing dynamic lists of accounts/OUs. AWS Control Tower primarily establishes a secure multi-account environment but doesn't directly manage WAF rules. Storing account/OU information in KMS is not its intended use, and using IAM users with access keys for programmatic access is less secure and less scalable than IAM roles.