Question

A company has been running AWS for three years with 40 accounts created manually and joined into an existing AWS Organizations structure. Leadership now wants centralized governance with automated account provisioning, mandatory logging, and a global standard that blocks any operation outside two approved AWS Regions. The security team wants to minimize custom development and use managed, opinionated guardrails wherever possible. Which approach best meets these requirements?

Accepted Answer

Deploy AWS Control Tower on the existing organization, enroll (adopt) the existing accounts into registered OUs, use Account Factory for future accounts, and apply the Region-deny mandatory guardrail.

Answer

Author a custom SCP that denies all actions when aws:RequestedRegion is not in the approved list, attach it manually to each of the 40 accounts, and build a Lambda-based account vending pipeline for new accounts.

Answer

Migrate all 40 accounts to a brand-new organization managed by Control Tower, since Control Tower cannot be layered onto an organization that already contains member accounts.

Answer

Enable AWS Config conformance packs with a Region-restriction rule and remediation actions across all accounts, relying on detective controls to revert any resources created outside the approved Regions.