A regulated bank is consolidating 80 AWS accounts after acquisitions, needs consistent guardrails that block risky actions, a standard landing zone for new business units, and self-service account provisioning with approvals. Which organizational design provides automated guardrails, landing zones, and account provisioning?
Select an answer to reveal the explanation.
Short Explanation
You're building neighborhoods with the same safety codes, not custom houses each time. Control Tower gives you landing zones plus Account Factory and guardrails on autopilot across OUs.
Full Explanation
AWS Control Tower builds on AWS Organizations to provide a landing zone with preconfigured OUs, baseline accounts, and guardrails implemented as SCPs and Config rules for preventive and detective control, while Account Factory automates account provisioning through a Service Catalog workflow with approvals and baseline customization. Creating Organizations with manual OUs and CloudFormation templates provides structure but lacks centralized guardrail enforcement, lifecycle management, and governed self-service provisioning. Using Organizations with SCPs and shared AMIs standardizes resources but misses automated landing zone setup, drift detection, and the Account Factory provisioning pipeline. Configuring IAM Identity Center with permission sets centralizes access management but does not create OUs, guardrails, or automated account vending, requiring manual processes that do not scale for 80 accounts. For the exam remember Control Tower equals governed landing zone plus guardrails plus Account Factory, and in practice verify guardrail compliance in the Control Tower dashboard after OU enrollment.