The company needs to ensure VPC flow logs are enabled for all current and future VPCs in the account. VPCs are managed with a CloudFormation stack, but users may create VPCs directly. Which approach enforces flow logs for existing and newly created VPCs by any IAM user?

AWS Config with a custom rule and automatic remediation is the most effective solution. It continuously monitors all VPCs (existing and newly created, regardless of creation method) for compliance with the flow log requirement. If a VPC is found without flow logs enabled, the automatic remediation action will enable them, ensuring consistent enforcement across the account. Adding an AWS::EC2::FlowLog resource to CloudFormation templates only applies to VPCs created via those specific templates, not to VPCs created directly or existing ones. Creating an AWS Organization and applying an SCP that prevents changes to VPC flow logs would not enable flow logs, only prevent their modification once configured. An IAM policy denying API calls related to VPC flow logs would prevent users from managing them, but wouldn't proactively enable them on all VPCs.