Question

A security team manages a multi-account environment through AWS Control Tower. The compliance department requires that every newly provisioned member account automatically block the disabling of AWS Config, enforce a standardized network baseline, and prevent the deletion of the CloudTrail log archive. The team wants these controls applied consistently at account creation without manual per-account setup, and wants strong (preventive) enforcement where possible. Which approach best meets these requirements with the least ongoing operational effort?

Accepted Answer

Use Account Factory to provision accounts and enable Control Tower's mandatory and strongly recommended guardrails, applying preventive guardrails (SCP-based) for actions like disabling Config and deleting the log archive, and detective guardrails where preventive options are unavailable.

Answer

Provision accounts with Account Factory and rely solely on detective guardrails, remediating any drift manually through the Control Tower dashboard after each account is created.

Answer

Disable Control Tower guardrails and instead attach custom IAM permission boundaries to every role in each new account to prevent Config and CloudTrail changes.

Answer

Create the accounts manually in AWS Organizations, then run a Systems Manager automation document on a schedule to detect and re-enable Config and CloudTrail if they are turned off.