Question

A financial services company uses AWS Control Tower to manage a multi-account environment. The security team must ensure that every newly vaccounted through Account Factory automatically has a standardized security baseline applied, including a mandatory detective control that flags any S3 bucket configured with public read access. This control must be reported centrally without preventing the provisioning of the account. The team wants to use Control Tower's native capability rather than building custom automation. Which approach meets these requirements?

Accepted Answer

Enable a Control Tower detective guardrail (managed by AWS Config rules) that detects publicly accessible S3 buckets; compliance status is aggregated in the Control Tower dashboard for all enrolled accounts.

Answer

Attach a preventive SCP to the organizational unit that denies the s3:PutBucketPublicAccessBlock action so buckets can never be made public.

Answer

Create a custom Lambda function triggered by Account Factory that scans S3 buckets and blocks account provisioning if a public bucket is found.

Answer

Enable a Control Tower proactive guardrail using AWS CloudFormation hooks to reject any account creation that includes public S3 buckets.