Question

A large enterprise runs AWS Organizations with Control Tower and about 200 member accounts across multiple OUs. Application teams frequently open individual Service Quotas increase requests (for example, Lambda concurrency and EC2 vCPU limits) in each new account, causing delays because default quotas are too low when accounts are freshly provisioned. The cloud platform team wants newly created accounts to automatically request higher quotas for a defined set of services and quotas without manual intervention in each account, and they want this to apply to accounts created in the future. Which approach best meets these requirements with the least ongoing operational effort?

Accepted Answer

Create a Service Quotas template in the Organizations management account that defines the desired quota increases per Region and service, and enable the template so it is automatically applied to accounts as they are created.

Answer

Write a Lambda function triggered by the Control Tower account creation lifecycle event that assumes a role in the new account and calls the Service Quotas RequestServiceQuotaIncrease API for each required quota.

Answer

Use an SCP attached to the root OU that raises the effective service quotas for Lambda concurrency and EC2 vCPU limits for all accounts in the organization.

Answer

Add the quota increase requests to the Control Tower Account Factory Terraform (AFT) customization pipeline so each provisioned account runs a CloudFormation stack that sets the quotas directly.