Question

A financial services company uses AWS Control Tower to govern a multi-account environment with over 80 accounts across several OUs. The security team requires that every newly provisioned account automatically receives a standardized set of baseline resources: a hardened VPC configuration, a specific IAM role for the SOC team, and an SNS topic subscription for security notifications. These resources are not covered by Control Tower guardrails or SCPs. The team wants this to happen automatically whenever Account Factory creates a new account, with minimal manual intervention. Which approach BEST meets these requirements?

Accepted Answer

Deploy Account Factory for Terraform (AFT) with account customization pipelines that apply the baseline resources automatically after each account is provisioned.

Answer

Add the baseline VPC, IAM role, and SNS subscription as detective Config rules in a conformance pack deployed via the delegated administrator account.

Answer

Create additional Control Tower guardrails that enforce the presence of the VPC, IAM role, and SNS subscription in every account.

Answer

Manually run a CloudFormation stack in each new account after it appears in the organization, using StackSets triggered by an operator.