Examkin

Question

Difficulty: HardMulti-Account Governance and Organizational Structure

A solutions architect is designing a multi-account environment using AWS Organizations and AWS Control Tower for a large enterprise. The architecture must enforce custom guardrails, structure accounts into business-specific Organizational Units (OUs), and automatically deploy custom local network resources (such as VPCs and security groups) during account onboarding. The solutions architect decided to use AWS Control Tower Lifecycle Events linked to an Amazon EventBridge rule that triggers an AWS Lambda function for post-enrollment customization.

Arrange the steps in the correct chronological order to establish this governed environment and ensure all target accounts are automatically customized upon enrollment.

  1. 1Initialize AWS Organizations and launch the AWS Control Tower landing zone from the management account.
  2. 2Create custom Organizational Units (OUs) within AWS Control Tower to structure workloads.
  3. 3Enable preventive guardrails (SCPs) and detective guardrails (AWS Config rules) on the custom OUs.
  4. 4Set up Amazon EventBridge rules to detect AWS Control Tower Lifecycle Events and trigger AWS Lambda.
  5. 5Enroll member accounts into the customized OUs using AWS Control Tower Account Factory.

Answer

To establish this environment and ensure all accounts are automated upon enrollment, the solutions architect must first launch the landing zone, create the custom OUs, apply guardrails, configure the EventBridge rules for lifecycle events, and finally enroll the member accounts via Account Factory.
The correct sequence starts with launching the landing zone and creating the custom OUs. Guardrails must be applied next to ensure immediate compliance. Crucially, the EventBridge rule for Lifecycle Events must be created before enrolling accounts to ensure that the orchestration workflow is active when the accounts are provisioned, allowing for automatic deployment of VPCs and security groups. Enrolling accounts is the final step that triggers this sequence.

Step-by-Step Solution

1
Initialize AWS Organizations and launch the AWS Control Tower landing zone from the management account.
Deploys core AWS Control Tower architecture including Security and Sandbox OUs, and Log Archive and Audit accounts.
This establishes the foundation required for any multi-account governance setup.
2
Create custom OUs in AWS Control Tower.
Creates workload-specific OUs in the organizational directory.
OUs must exist to act as containers for member accounts and policy attachments.
3
Apply guardrails (SCPs and Config rules) to the custom OUs.
Enforces guardrail compliance policies on the selected OUs.
Enforces governance guardrails before accounts are placed in the OUs, avoiding any temporary compliance gaps.
4
Create the Amazon EventBridge rule that detects AWS Control Tower Lifecycle Events and targets AWS Lambda.
Prepares the event listener for the CreateManagedAccount event.
Ensures that the event-driven customization workflow is active before the accounts are created; otherwise, the creation events will not trigger the Lambda function.
5
Enroll member accounts using AWS Control Tower Account Factory into the target OUs.
Accounts are created, placed in OUs under the applied guardrails, and trigger the EventBridge rule to complete local setup.
This initiates the creation sequence, relying on pre-existing guardrails and event rules to secure and customize the accounts automatically.

Key Concept

AWS Control Tower Lifecycle Events and multi-account governance setup flow
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic