A growing enterprise now has 80 AWS accounts created manually with inconsistent baselines, no preventive guardrails, and slow procurement. Security demands centrally managed structure, policy enforcement, and fast compliant account vending. Which organizational design provides governed landing zone provisioning?
Select an answer to reveal the explanation.
Short Explanation
You're running a city with no zoning and hand-built houses everywhere. Control Tower lays streets, codes, and permits with OUs and Account Factory, so new accounts arrive inspection-ready.
Full Explanation
AWS Control Tower establishes a landing zone with account baselines, preventive and detective guardrails, and integration with Organizations OUs, while Account Factory provides templated, approved vending of new accounts that inherit policies and logging. Manual IAM users with shared root credentials violate security baselines, provide no guardrails, and cannot scale compliant provisioning. Ad hoc SCPs on one OU without Control Tower lack baseline configuration, drift detection, and vending automation, leaving procurement slow and inconsistent. Single-account Config rules cannot enforce organization-wide prevention or automate multi-account structure. Exam caveat is to choose Control Tower plus Organizations and Account Factory when stems mention guardrails, landing zone, and automated provisioning, and practical check is to define OU topology, guardrail intent, and network and logging defaults before vending.