Question

A financial services company uses AWS Control Tower to govern 60 member accounts across several OUs. A platform engineer, using local credentials in a workload account, manually modified an AWS Config recorder and detached a CloudTrail trail that Control Tower had configured during account enrollment. The security team wants Control Tower to detect this deviation and restore the mandatory baseline resources to their governed state without re-provisioning the account. Which action accomplishes this with the least operational effort?

Accepted Answer

Run the 'Re-register OU' / repair action in Control Tower, which re-applies the landing zone baseline and remediates drift on the affected account's guardrail resources.

Answer

Delete and close the affected account, then use Account Factory to provision a brand-new account with the correct baseline.

Answer

Attach an SCP that denies config:StopConfigurationRecorder and cloudtrail:DeleteTrail so the drift is automatically reverted.

Answer

Manually recreate the Config recorder and CloudTrail trail in the workload account to match other accounts' settings.