AWS Certified Solutions Architect – ProfessionalDesign for New SolutionsEasy
A large enterprise wants to establish a secure and compliant landing zone on AWS for all new accounts and workloads. The landing zone needs to enforce security best practices, centralize logging and auditing, manage multiple AWS accounts, and ensure governance across the organization. The solution must be highly automated and provide guardrails to prevent deviations from compliance. Which AWS service is explicitly designed to meet these requirements?
- AAWS Config with Custom Config Rules.
- BAWS Control Tower.
- CAWS Organizations with Service Control Policies (SCPs).
- DAWS Security Hub with integrated compliance checks.
Show answer & explanationAnswer & explanation
Correct answer: B. AWS Control Tower.
AWS Control Tower is specifically designed to set up and govern a secure, multi-account AWS environment (a landing zone). It automates the setup of accounts, implements best practices, centralizes logging/auditing, and provides guardrails to enforce compliance.
Why the other options are wrong
- A. AWS Config monitors resource configurations and enforces compliance rules but doesn't provision a multi-account landing zone or centralize logging/auditing across accounts.
- C. AWS Organizations helps manage multiple accounts and SCPs enforce policies, but it's a foundational service and doesn't provide the full automated landing zone setup, centralized logging/auditing, or comprehensive guardrails out-of-the-box like Control Tower.
- D. AWS Security Hub aggregates security findings and performs compliance checks but doesn't establish the foundational landing zone, account structure, or enforce guardrails at the provisioning stage.
AWS Control Tower
AWS Control Tower simplifies the process of setting up and governing a secure, multi-account AWS environment, also known as a landing zone. It provides a prescriptive approach to establishing best practices.
- Automates the creation of a multi-account AWS landing zone.
- Implements guardrails to enforce compliance and governance.
- Centralizes logging and auditing across all accounts.
Memory trick: Control Tower Builds and Governs Your AWS Home.