Examkin

Question

Difficulty: Very hardMulti-Account Governance and Organizational Structure

An enterprise is integrating a newly acquired, standalone AWS account into its AWS Organizations structure managed by AWS Control Tower. The solutions architect must prepare the account for enrollment while preventing errors due to pre-existing resources and ensuring the environment conforms to the landing zone's centralized policies. Arrange the following steps in the correct chronological sequence to successfully onboard and baseline this account in AWS Control Tower.

  1. 1Send an invitation to the standalone account from the AWS Organizations management account, and accept the invitation in the billing console of the standalone account.
  2. 2Create an IAM role named AWSControlTowerExecution in the standalone account, attaching the AdministratorAccess policy and trusting the organization's management account.
  3. 3Delete or disable any pre-existing AWS Config configuration recorders and delivery channels in all AWS Regions supported by the Control Tower landing zone.
  4. 4Move the standalone account from the Root organizational unit (OU) into an OU that has been registered and is governed by AWS Control Tower.
  5. 5Select the member account from the AWS Control Tower console's account list and initiate the account enrollment operation.

Answer

The correct sequence starts with inviting the standalone account to join the organization, followed by creating the cross-account administrative role, removing any active AWS Config recorders and delivery channels, moving the account to a registered organizational unit, and finally triggering the AWS Control Tower enrollment.
The correct onboarding sequence ensures that the target account is first brought into the organization boundary, after which the administrative trust role (AWSControlTowerExecution) is established. Before invoking enrollment, any conflicting local AWS Config resources must be deleted to prevent StackSet failures. The account is then moved into the registered OU, and the enrollment process is triggered to apply Control Tower's baselines and guardrails.

Step-by-Step Solution

1
Invite and accept the standalone account into the organization.
The standalone account is successfully added to the AWS Organization as a member account.
This establishes the organizational boundary and trust required for subsequent configuration.
2
Create the AWSControlTowerExecution IAM role in the member account.
An IAM role named AWSControlTowerExecution with AdministratorAccess is established, trusting the management account.
AWS Control Tower must have delegated administrative access to configure resources and establish baselines in the member account.
3
Delete existing AWS Config recorders and delivery channels.
All existing local AWS Config configuration recorders and delivery channels are removed in the target regions.
This prevents configuration duplication errors that automatically fail the AWS Control Tower stack execution during enrollment.
4
Move the member account into a governed Organizational Unit.
The account is relocated to an OU registered under AWS Control Tower control.
This step ensures that once enrollment is initiated, the correct SCPs and default configurations are inherited by the account.
5
Initiate enrollment from the AWS Control Tower console.
The enrollment process executes, setting up baselines and guardrails.
This triggers the final orchestration steps to officially enroll the account under Control Tower management.

Key Concept

AWS Control Tower Account Onboarding Workflow
Estimated Time:3m 0s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic