Teams need new AWS accounts provisioned in minutes, pre-configured with guardrails, logging, network baselines, and OU placement — no tickets to a central team. What delivers this?
A.Manual account creation via the console
Manual = bottleneck + inconsistent baselines.
B.Control Tower Account Factory (with account vending via Service Catalog)
Correct. Self-service governed account provisioning.
C.Creating IAM users in the master account
Users share one account — no blast-radius separation.
D.Duplicating a CloudFormation template
Templates configure resources, not governed account creation.
Why this answer
Account Factory is Control Tower's self-service account vending — provisions governed accounts with baseline guardrails, enrolled in the right OU, in minutes. Manual creation can't scale governance; IAM users aren't account isolation.
Correct answer: B · Last reviewed 2026-11-04
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Multi-Account Architecture practice session.
Practice Multi-Account Architecture