Question

A financial services company currently manages 12 AWS accounts under AWS Organizations, created manually over the past two years. Each account was set up inconsistently — some lack baseline CloudTrail configuration, centralized logging, or standardized IAM roles. The security team must scale to over 100 accounts in the next year and needs every new account to be provisioned with a consistent, pre-approved security baseline (centralized logging to a dedicated log archive account, mandatory guardrails, and a standard network configuration) with minimal manual effort. Which approach best meets these requirements?

Accepted Answer

Deploy AWS Control Tower on the existing organization and use Account Factory to provision new accounts from a standardized blueprint that applies guardrails and the logging baseline automatically.

Answer

Write a custom CloudFormation template and manually run it in each new member account after creating the account through the AWS Organizations console.

Answer

Attach a service control policy at the organization root that forces new accounts to enable CloudTrail and centralized logging when they are created.

Answer

Enable AWS Config conformance packs in every account and rely on auto-remediation to bring newly created accounts into compliance with the baseline.