You need to enforce server-side encryption for all EBS volumes and SQS queues created or updated by CloudFormation stacks in all accounts within a specific OU, and enforcement must occur before CloudFormation stack operations. Which solution will enforce this across the OU?

The correct solution leverages CloudFormation Hooks and StackSets. CloudFormation Hooks allow you to invoke custom logic before or after CloudFormation creates, updates, or deletes resources. By creating a hook that enforces server-side encryption for EBS and SQS, and deploying it across the OU using StackSets (which manage CloudFormation stacks across multiple accounts), you ensure enforcement occurs proactively and uniformly. AWS Config and Systems Manager can audit compliance but don't prevent non-compliant resource creation before it happens. An SCP can deny creation but is less granular than a hook, potentially blocking legitimate operations if not perfectly crafted. A Lambda function could check compliance post-creation but wouldn't prevent the initial creation of non-compliant resources, failing the "before CloudFormation stack operations" requirement.