AWS Certified Solutions Architect – ProfessionalDesign for New SolutionsMedium
A global financial institution is expanding its operations into new regions and needs to establish a secure, multi-account AWS environment for its new regional teams. The environment must enforce strict compliance policies, centralize logging and auditing, and allow for rapid provisioning of new accounts while adhering to organizational guardrails. Which AWS service should a solutions architect recommend to meet these requirements?
- AAWS Organizations
- BAWS Control Tower
- CAWS CloudFormation StackSets
- DAWS Service Catalog
Show answer & explanationAnswer & explanation
Correct answer: B. AWS Control Tower
AWS Control Tower establishes a secure, compliant, multi-account AWS environment (landing zone), centralizes logging/auditing, and uses guardrails to enforce policies. It also streamlines the provisioning of new accounts, directly addressing all stated requirements.
Why the other options are wrong
- A. AWS Organizations helps manage multiple AWS accounts and implement SCPs but does not provide the full landing zone setup, automated guardrails, or centralized logging/auditing capabilities of Control Tower.
- C. AWS CloudFormation StackSets enable deploying CloudFormation stacks across multiple accounts and regions, which can be part of setting up an environment, but it does not provide the comprehensive landing zone, guardrails, and governance features of Control Tower.
- D. AWS Service Catalog allows organizations to create and manage catalogs of IT services that are approved for use on AWS, but it's a tool for service provisioning, not for setting up the foundational secure multi-account environment itself.
AWS Control Tower
A service that provides an easy way to set up and govern a secure, multi-account AWS environment (landing zone), enforcing best practices, security, and compliance across all accounts.
- Automates landing zone setup.
- Enforces guardrails for security and compliance.
- Centralizes logging and auditing.
- Simplifies new account provisioning.
Memory trick: Control Tower is the central command for your AWS empire, keeping everything secure and in line.