Question

A financial services company is expanding its AWS footprint and expects to onboard dozens of new accounts over the next year for different project teams. The security team wants every new account to automatically have a standardized baseline: centralized logging to a dedicated account, mandatory encryption configurations, and preventive controls that block non-compliant actions. They also want a dashboard showing which accounts drift from the required baseline. Which approach best meets these requirements with the least ongoing operational effort?

Accepted Answer

Deploy AWS Control Tower to establish a landing zone with an account factory, and apply mandatory and detective guardrails across the organizational units.

Answer

Manually create each account under AWS Organizations and attach a large service control policy to the root that enforces all required controls.

Answer

Write a custom AWS Lambda function triggered by CloudTrail that inspects new accounts and applies IAM policies and logging configurations.

Answer

Use AWS Config in each account individually with conformance packs, and have administrators review compliance reports weekly.