The organization uses AWS Organizations and enabled AWS Config across member accounts via CloudFormation StackSets. Trusted access is enabled and a member account is the delegated administrator for AWS Config. The security team needs a centralized security baseline of AWS Config rules (including remediation actions) that is enforced for all existing and future member accounts. Non-admin users in member accounts must be prevented from modifying the centrally managed baseline. Which approach satisfies these requirements?

The correct approach is to create an AWS Config conformance pack and deploy it from the delegated administrator account using AWS Config. Conformance packs allow you to package a collection of AWS Config rules and remediation actions into a single entity, making it ideal for centralized management and deployment across multiple accounts. Deploying from the delegated administrator account ensures that the centralized security baseline is managed from the designated Config hub, and AWS Config itself handles the deployment to all member accounts within the organization, including future accounts. This also prevents non-admin users in member accounts from modifying the centrally managed baseline. Using CloudFormation StackSets to deploy a CloudFormation template is less ideal because conformance packs are specifically designed for this use case and offer a more integrated solution within AWS Config for managing rule sets. Deploying from the management account via StackSets would work for general CloudFormation templates but doesn't leverage the specialized capabilities of AWS Config's delegated administrator and conformance packs for organization-wide rule enforcement.