A manufacturing firm has 30 existing AWS accounts in an organization and wants standardized baselines, new accounts via self-service, plus stronger logging controls beyond defaults and custom encryption checks. Engineers fear migration downtime for existing workloads. Which Control Tower approach should the lead adopt to govern new and existing accounts centrally?
Select an answer to reveal the explanation.
Short Explanation
You don't need to rebuild everything to get guardrails. Control Tower lets you enroll what you've got and raise the bar gradually.
Full Explanation
The correct approach succeeds because a Control Tower landing zone establishes centralized identity, preventive and detective baselines, and centralized logging for governance, enrolling the 30 existing organization accounts brings them under that baseline in place without workload recreation which directly resolves downtime fear, Account Factory provides standardized self-service provisioning for new accounts, optional controls harden logging beyond defaults, and custom controls deployed with Customizations for AWS Control Tower (CfCT) and CloudFormation implement the specific encryption checks. The alternative that creates the landing zone with Account Factory but leaves existing accounts outside enrollment fails on centralized scope since unenrolled accounts receive no baseline enforcement, drift detection, or aggregated logging and the central governance goal is unmet. The alternative that enrolls accounts with Account Factory and enhanced logging using only managed guardrails fails on extensibility since managed controls cover AWS best practices but cannot express customer-specific encryption logic that requires custom control code. The alternative that enrolls accounts with Account Factory and custom encryption controls using only default logging fails on observability since defaults lack expanded central retention, immutability, and analytical controls. On the exam, distinguish enrollment without migration from greenfield recreation and do not confuse Organizations billing features with Control Tower governance. Practically, confirm every account reports Enrolled, launch a test account via Account Factory, and verify optional and custom control compliance status in Security Hub and Control Tower dashboards.