You must apply a core set of security baseline resources across existing AWS accounts in an Organization. Account teams have AdministratorAccess per account. CloudTrail and AWS Config must be enabled in all Regions and baseline resources must not be editable or deletable by individual account admins, but those admins must be allowed to edit/delete their own CloudTrail trails and AWS Config rules. Which solution is the most operationally efficient?

The correct solution leverages CloudFormation StackSets for efficient, consistent deployment of baseline resources across accounts. An SCP (Service Control Policy) is then used to prevent account administrators from modifying or deleting these critical resources (CloudTrail and AWS Config) unless the action originates from the organization's management account. This satisfies the requirement for immutability while allowing account admins to manage their own CloudTrail trails and AWS Config rules, as the SCP specifically targets the baseline resources. Option 1 is incorrect because a CloudFormation stack policy only applies to the stack itself, not the resources created by the stack, and it wouldn't prevent direct resource modification. Option 2 is incorrect because AWS Control Tower enrollment of existing accounts can be complex and disruptive, and it doesn't inherently prevent account admins from modifying baseline resources without additional controls. Option 3 is incorrect because it designates an AWS Config management account, which isn't necessary for organization-wide Config rules, and the SCP applied only to Config recorders wouldn't cover CloudTrail or other baseline resources.