Question

A financial services company uses AWS Control Tower to govern 120 accounts across multiple OUs. The security team wants every NEW account created through Account Factory to automatically have a standardized set of baseline resources deployed — a hardened VPC configuration, a centralized logging IAM role, and an AWS Config custom rule — as part of the account provisioning process, without requiring manual steps after account creation. Which approach best meets this requirement?

Accepted Answer

Implement Account Factory for Terraform (AFT) with account customizations so the baseline resources are deployed automatically during the account provisioning pipeline

Answer

Attach a service control policy (SCP) to the OU that denies all actions until the required baseline resources exist in the account

Answer

Deploy a Config conformance pack to the organization so that the baseline resources are created in each new account when it is enrolled

Answer

Enable additional Control Tower mandatory guardrails that provision the VPC, IAM role, and Config rule automatically in every account