nerdexam
Amazon

SAA-C03 · Question #218

A global company is migrating its workloads from an on-premises data center to AWS. The AWS environment includes multiple AWS accounts. IAM roles. AWS Config rules, and a VPC. The company wants an…

The correct answer is A. Use AWS Control Tower to set up an organization in AWS Organizations. Use AWS Control. A global company needs an automated solution to provision new AWS accounts on demand, including pre-configured IAM roles, AWS Config rules, and VPCs, with the least effort.

Submitted by khalil_dz· Mar 4, 2026Design Secure Architectures

Question

A global company is migrating its workloads from an on-premises data center to AWS. The AWS environment includes multiple AWS accounts. IAM roles. AWS Config rules, and a VPC. The company wants an automated process to provision new accounts on demand when the company's business units require new accounts. Which solution will meet these requirements with LEAST effort?

Options

  • AUse AWS Control Tower to set up an organization in AWS Organizations. Use AWS Control
  • BCreate an organization in AWS Organizations. Use the AWS CLI CreateAccount API action to
  • CCreate an AWS Lambda function that uses the AWS Organizations API to create new accounts.
  • DCreate an organization in AWS Organizations. Use AWS Step Functions to orchestrate the

How the community answered

(48 responses)
  • A
    83% (40)
  • B
    4% (2)
  • C
    2% (1)
  • D
    10% (5)

Why each option

A global company needs an automated solution to provision new AWS accounts on demand, including pre-configured IAM roles, AWS Config rules, and VPCs, with the least effort.

AUse AWS Control Tower to set up an organization in AWS Organizations. Use AWS ControlCorrect

AWS Control Tower automates the setup of a well-architected multi-account AWS environment and provides an Account Factory that enables self-service provisioning of new accounts with pre-defined baselines (including IAM, Config, and VPCs), significantly reducing operational effort compared to manual or custom scripting solutions.

BCreate an organization in AWS Organizations. Use the AWS CLI CreateAccount API action to

Using the AWS CLI CreateAccount API action only creates the account; it does not automate the configuration of IAM roles, AWS Config rules, or VPCs within the new account, requiring significant additional manual or scripted effort.

CCreate an AWS Lambda function that uses the AWS Organizations API to create new accounts.

Creating a custom AWS Lambda function to use the AWS Organizations API for account creation would require extensive development to implement and maintain all the desired configurations (IAM, Config, VPC) and governance, which is more effort than using a managed service like Control Tower.

DCreate an organization in AWS Organizations. Use AWS Step Functions to orchestrate the

While AWS Step Functions can orchestrate complex workflows, orchestrating the entire account provisioning process along with all baseline configurations (IAM, Config, VPC) from scratch would involve substantial custom development and ongoing maintenance, making it higher effort than AWS Control Tower.

Concept tested: Multi-account AWS environment provisioning and governance

Source: https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAA-C03 Practice