Question

A company is designing multi-account governance for AWS. The CISO wants a standardized landing zone with pre-configured guardrails, a dedicated log archive account, and an automated account provisioning process. The finance team is concerned about the operational overhead and wants to minimize the effort of maintaining the baseline as new accounts join. The company has no existing multi-account structure. Which approach best meets these requirements with the least ongoing management effort?

Accepted Answer

Deploy AWS Control Tower to establish a landing zone with a management account, log archive and audit accounts, mandatory and strongly recommended guardrails, and Account Factory for provisioning.

Answer

Create an AWS Organization manually, author custom SCPs for each OU, and build a CloudFormation StackSet pipeline to deploy logging and baseline resources to each new account.

Answer

Use AWS Organizations with a single OU, enable all-features mode, and rely on Security Hub central configuration to enforce guardrails across accounts.

Answer

Provision each account individually and apply IAM permission boundaries in every account to enforce a consistent security baseline.