AWS Certified Solutions Architect – ProfessionalDesign for New SolutionsMedium
A global financial institution is expanding its operations into new regions and needs to establish a secure and compliant landing zone on AWS for all new accounts. The solution must enforce security best practices, provide centralized logging and monitoring, and automate account provisioning across multiple AWS accounts and regions. Which AWS service provides the most comprehensive solution for these requirements?
- AAWS Organizations with Service Control Policies (SCPs)
- BAWS Control Tower
- CAWS CloudFormation StackSets
- DAWS Security Hub with AWS Config
Show answer & explanationAnswer & explanation
Correct answer: B. AWS Control Tower
AWS Control Tower is specifically designed to set up and govern a secure, multi-account AWS environment (landing zone) with best practices, centralized logging, monitoring, and automated account provisioning, directly addressing all the stated requirements.
Why the other options are wrong
- A. AWS Organizations and SCPs are foundational for multi-account governance but do not provide the full automation for account provisioning, logging, and monitoring that Control Tower offers.
- C. AWS CloudFormation StackSets can deploy resources across accounts/regions but require significant manual effort to build out a complete secure landing zone with all the integrated features of Control Tower.
- D. AWS Security Hub and AWS Config are excellent for security posture management and compliance auditing but do not automate the entire landing zone setup and account provisioning process.
AWS Control Tower
A service that provides an easy way to set up and govern a secure, multi-account AWS environment, called a landing zone.
- Automates the setup of a secure baseline.
- Implements guardrails for governance and compliance.
- Provides centralized logging, monitoring, and account provisioning.
Memory trick: Control Tower Builds a Secure Base for Your AWS Empire.