Question

A company has been growing organically and now runs 40 AWS accounts that were each created independently using the AWS Organizations 'create account' and 'invite existing account' features. There is no consistent baseline: some accounts lack CloudTrail, encryption defaults vary, and there is no standardized logging or audit account. Leadership wants a governed, repeatable way to provision NEW accounts going forward with a mandatory baseline (centralized logging, guardrails, standardized VPC) and a dashboard showing drift across all accounts, while minimizing custom-built automation. Which approach best meets these requirements?

Accepted Answer

Deploy AWS Control Tower to establish a landing zone with a management, log archive, and audit account, then use Account Factory to provision new accounts with mandatory guardrails and baselines, and enroll existing accounts where feasible.

Answer

Continue using AWS Organizations, attach SCPs to the root, and write a custom Lambda-based provisioning pipeline triggered by CreateAccount events to apply baselines to each new account.

Answer

Enable AWS Config in every account manually and build a conformance pack that recreates all guardrails, using CloudFormation StackSets to push baseline resources to new accounts.

Answer

Migrate all workloads into a single account with multiple VPCs to eliminate cross-account inconsistency, and apply IAM permission boundaries per team.