Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

An organization plans to establish a secure, multi-account AWS environment using AWS Control Tower. The solutions architect must prepare the account, launch the landing zone, establish centralized access, register organizational units, enroll new member accounts under governance, and deploy custom policies across the entire organization. Arrange the steps in the correct chronological order to implement this governance solution.

  1. 1Disable any pre-existing AWS Config configuration recorders and delivery channels in the management account across all supported regions.
  2. 2Set up and launch the AWS Control Tower landing zone from the management account to establish core logging and security accounts.
  3. 3Configure AWS IAM Identity Center to federate access and assign permission sets to administrative groups.
  4. 4Create custom Organizational Units (OUs) in AWS Organizations and register them with AWS Control Tower to extend guardrails.
  5. 5Provision new workload accounts through the AWS Control Tower Account Factory to ensure automatic enrollment and guardrail inheritance.
  6. 6Deploy the Customizations for AWS Control Tower (CfCT) framework to apply custom Service Control Policies (SCPs) across the registered OUs.

Answer

The correct chronological sequence is to first disable any pre-existing AWS Config configuration recorders and delivery channels, second set up and launch the AWS Control Tower landing zone, third configure AWS IAM Identity Center for federated administrative access, fourth create and register custom OUs with Control Tower, fifth provision new workload accounts using Account Factory, and finally deploy the Customizations for AWS Control Tower (CfCT) framework to apply custom Service Control Policies (SCPs).
Establishing a secure multi-account environment with AWS Control Tower requires a strict ordering. First, pre-existing AWS Config configuration recorders must be disabled in the management account to avoid setup conflicts. Next, the AWS Control Tower landing zone is launched to create core accounts (logging, security) and OUs. Once the environment is initialized, AWS IAM Identity Center is configured to define federated access. Following this, custom OUs must be created and registered under AWS Control Tower governance. Member accounts can then be provisioned using the Account Factory so that they inherit these guardrails from the start. Finally, custom policies and resources are deployed using the Customizations for AWS Control Tower (CfCT) framework once the organizational structure and accounts are in place.

Step-by-Step Solution

1
Prepare the management account by disabling existing AWS Config configuration recorders and delivery channels.
Potential landing zone initialization failures due to duplicate AWS Config recorders are avoided.
AWS Control Tower manages its own AWS Config recorders, and existing ones will cause the landing zone deployment to fail.
2
Launch the AWS Control Tower landing zone.
The core Organization structure, Security OU, Sandbox OU, Log Archive account, and Security Audit account are deployed.
This establishes the foundational multi-account framework and default guardrails.
3
Configure AWS IAM Identity Center.
Federated identity access is established and permission sets are mapped to users and groups.
Administrators must be able to log in to the newly generated core accounts before configuring additional resources.
4
Create and register custom OUs.
Custom OUs are registered under AWS Control Tower governance.
Workload segregation requires custom OUs, which must be registered with Control Tower to receive guardrails.
5
Enroll accounts via Account Factory.
New member accounts are provisioned, linked to the registered OUs, and standard VPCs are set up.
Provisioning accounts through Account Factory ensures they are automatically governed and compliant from creation.
6
Deploy the Customizations for AWS Control Tower (CfCT) framework.
Custom SCPs and CloudFormation resources are automatically deployed to the target OUs.
Customizations are applied as the final layer of governance once accounts and OUs are established.

Key Concept

AWS Control Tower Landing Zone Setup and Governance Customization Sequence
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic