An organization has all features enabled in AWS Organizations, with 10 accounts now and plans to grow to ~500 accounts and multiple OUs. CloudTrail and AWS Config are enabled in existing accounts. How can you ensure AWS Config is automatically enabled for every new account created in the organization?

The correct answer leverages AWS CloudFormation StackSets with automatic deployment, which is the most scalable and automated way to provision and manage AWS Config across new accounts in an AWS Organization. StackSets allow you to define a CloudFormation template once and deploy it to multiple accounts and regions, including automatically deploying to new accounts as they join the organization. The other options are less suitable: Creating an EventBridge rule to invoke a Lambda function to enable trusted access for AWS Config is incorrect because trusted access is for the organization, not for enabling Config in individual accounts. While a Lambda could enable Config, StackSets provide a more robust and declarative solution for managing configurations across many accounts. An SCP only allows actions; it doesn't perform them. An SCP cannot automatically enable AWS Config. An EventBridge rule invoking a Systems Manager Automation runbook could work but is generally more complex and less declarative than a CloudFormation StackSet for this specific use case of consistent resource provisioning. StackSets are designed for this exact scenario.