Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

An enterprise is planning to establish a governed, multi-account AWS environment. The security team requires that all workload accounts inherit custom security baseline policies immediately upon creation or enrollment. The solutions architect decided to implement AWS Control Tower to manage this environment. The architect needs to initialize the landing zone, prepare the account hierarchy, configure custom guardrails, and onboard an existing standalone AWS account into the environment. Arrange the following steps in the correct chronological sequence to implement this architecture while ensuring no account is left temporarily un-governed.

  1. 1Initialize AWS Control Tower in the management account to deploy the baseline landing zone, creating the Log Archive and Audit accounts.
  2. 2Create a custom Organizational Unit (OU) within the AWS Control Tower console or register an existing OU to group application workload accounts.
  3. 3Attach the custom Service Control Policies (SCPs) to the custom OU to define the baseline security boundaries.
  4. 4Enroll the existing standalone AWS account into the governed custom OU using the AWS Control Tower console or Account Factory.

Answer

The correct sequence is: first, initialize AWS Control Tower in the management account to set up the baseline landing zone; second, create or register a custom Organizational Unit (OU) for workloads; third, apply custom Service Control Policies (SCPs) to the custom OU to establish the security boundaries; and fourth, enroll the existing standalone account into the pre-configured custom OU.
Initializing AWS Control Tower first is necessary to establish the landing zone. Next, the custom OU must be created to hold the workload accounts. Attaching the custom SCPs to this OU before enrolling accounts is a critical security best practice, ensuring that the target environment is already secure. Finally, enrolling the account ensures it immediately inherits all landing zone baselines and custom SCPs without any governance gaps.

Step-by-Step Solution

1
Initialize the AWS Control Tower landing zone in the AWS Organizations management account.
Creates the core infrastructure, including the Security OU, Log Archive account, and Audit account, and enables Account Factory.
You cannot enroll accounts or manage OUs under AWS Control Tower governance until the landing zone is initialized.
2
Create or register a custom Organizational Unit (OU).
Establishes a container for workload accounts under AWS Control Tower governance.
Workload accounts require a separate OU container to segregate them from the core security and management accounts.
3
Attach custom Service Control Policies (SCPs) to the custom OU.
Establishes preventive guardrails on the OU before any member accounts are added.
Applying policies to the OU before enrolling accounts prevents a security gap where an account is active in the organization but not yet subject to the custom restrictions.
4
Enroll the existing standalone AWS account into the custom OU.
The existing account is brought under AWS Control Tower governance and immediately inherits the custom SCPs.
Enrolling the account is the final step, ensuring it is securely governed from the exact moment it joins the OU.

Key Concept

Chronological onboarding and policy application sequence in AWS Control Tower multi-account governance.
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic