AWS Certified Solutions Architect – ProfessionalDesign for New SolutionsMedium
A large enterprise wants to establish a secure and compliant landing zone on AWS for all new accounts. The landing zone must enforce security best practices, provide centralized logging and auditing, and allow for automated provisioning of new accounts with predefined guardrails. Which AWS service combination is best suited to achieve these requirements?
- AAWS Landing Zone Solution (deprecated), AWS WAF for security, and Amazon CloudWatch for monitoring.
- BAWS Control Tower for automated landing zone setup, AWS Organizations for multi-account management, and AWS Config for compliance auditing.
- CAWS Service Catalog for provisioning, AWS IAM for access control, and Amazon GuardDuty for threat detection.
- DAWS Organizations for account management, AWS CloudFormation for resource provisioning, and AWS Shield for security.
Show answer & explanationAnswer & explanation
Correct answer: B. AWS Control Tower for automated landing zone setup, AWS Organizations for multi-account management, and AWS Config for compliance auditing.
AWS Control Tower provides an automated way to set up and govern a secure, multi-account AWS environment (landing zone). It leverages AWS Organizations for account management, AWS Config for compliance auditing and guardrails, and integrates with CloudTrail and CloudWatch for centralized logging and monitoring. This combination directly addresses all requirements.
Why the other options are wrong
- A. AWS Landing Zone Solution has been replaced by AWS Control Tower. AWS WAF is for web application firewall, and CloudWatch is for monitoring, but they do not provide the full scope of a landing zone setup with automated guardrails and centralized management.
- C. AWS Service Catalog helps users provision approved products but doesn't establish the entire landing zone. IAM is for access control, and GuardDuty is for threat detection, but they don't provide the foundational automation and governance for a landing zone.
- D. CloudFormation is for resource provisioning but doesn't provide the complete automated landing zone setup or compliance guardrails. AWS Shield is for DDoS protection, not comprehensive landing zone security.
AWS Control Tower
An AWS service that provides an easy way to set up and govern a secure, multi-account AWS environment (landing zone) with best practices.
- Automates landing zone setup.
- Leverages AWS Organizations for multi-account management.
- Enforces guardrails using AWS Config.
- Provides centralized logging and auditing (CloudTrail, CloudWatch).
- Simplifies new account provisioning with governance.
Memory trick: Control Tower builds your landing zone, secure and compliant.