Question

A large enterprise is scaling from 15 to over 200 AWS accounts. They currently provision new accounts manually, which leads to inconsistent guardrails, missing centralized logging, and non-standard VPC configurations. The cloud platform team wants a repeatable, governed process that automatically applies preventive and detective controls, enrolls new accounts into the correct organizational units, and configures a standardized network baseline — while allowing application teams to request accounts through a self-service workflow. Which approach best meets these requirements with the least ongoing operational overhead?

Accepted Answer

Deploy AWS Control Tower and use Account Factory (or Account Factory for Terraform) to provision new accounts, enroll them into predefined OUs with mandatory and elective guardrails applied automatically.

Answer

Use AWS Organizations APIs with a custom Lambda function that creates member accounts, then manually attach SCPs and configure CloudTrail and Config in each new account.

Answer

Create a golden account AMI and CloudFormation template that teams launch through the AWS Service Catalog, copying the configuration into each new account they create.

Answer

Enable AWS Config aggregators and AWS Firewall Manager across the management account so that any newly created account inherits the required baseline automatically.