Management and Security Governance
Guardrails at organization scale
AWS Organizations is the root of governance: OUs structure accounts, SCPs enforce preventive controls, tag policies standardize tagging, backup policies centralize AWS Backup, and consolidated billing rolls up cost. Delegate administration for GuardDuty, Security Hub, Config, and Macie to a security account so the management account stays out of the day-to-day path.
Control Tower builds a landing zone on top of Organizations: it creates log archive and audit accounts, applies preventive guardrails (SCPs) and detective guardrails (Config rules), and provisions accounts through Account Factory with your baseline. If a question asks for a multi-account baseline "with the least operational overhead," Control Tower is usually the answer.
Continuous compliance
AWS Config records resource configuration and evaluates rules - AWS managed, or custom via Lambda or Guard. It is regional, so enable it in every Region you use and aggregate with a Config aggregator. Remediation runs through SSM Automation documents; Config itself never blocks an API call. Conformance packs bundle rules for a framework.
Security Hub aggregates findings across accounts and Regions, runs standards such as FSBP and CIS, and supports cross-Region aggregation plus a delegated administrator. Audit Manager automates evidence collection for frameworks like SOC 2 and PCI DSS so you are not screenshotting consoles. Trusted Advisor's security category flags open ports, public buckets, and missing root MFA; the full check set requires Business or Enterprise Support.
Traps
SCPs do not apply to the management account. Config rules are detective, not preventive - a question asking to "prevent" needs an SCP, IAM condition, or resource policy. Security Hub does not remediate by default. Deleting a Config recorder loses history.
Worked example: "Prevent unencrypted EBS volumes organization-wide." Answer: an SCP on the workload OUs denying ec2:CreateVolume unless ec2:Encrypted is true, with a Config rule and EventBridge-driven remediation as the detective backstop - not a Config rule alone.