Management and Security Governance
Guardrails, not gatekeepers
AWS Organizations gives consolidated billing, SCPs, tag policies and backup policies, and lets you designate delegated administrators for GuardDuty, Security Hub, Config and Macie so a security account can manage the whole estate. SCPs are preventive: they cap what principals in member accounts can do, do not affect the management account, and never grant anything. Control Tower builds a landing zone on top of this with Account Factory and guardrails - preventive guardrails are SCPs, detective guardrails are Config rules.
Detect, record, prove
AWS Config inventories resources and evaluates rules; conformance packs bundle rules into a framework, aggregators roll up multi-account, multi-region compliance, and remediation runs through SSM Automation. AWS Audit Manager automates evidence collection against frameworks such as PCI DSS and SOC 2 - it is not a detector. AWS Artifact supplies the reports themselves (SOC, ISO, PCI) and agreements such as the BAA. Security Hub gives an aggregated compliance score and cross-account finding view. Trusted Advisor offers checks across cost, security and fault tolerance, but the full set needs Business or Enterprise support.
Organising the estate
Separate accounts by function - security tooling, log archive, shared services, workloads - and centralise logs in the log-archive account with cross-account delivery. Tag for ownership and cost allocation, enforce with tag policies, and protect data with AWS Backup and Organizations backup policies.
Rule of thumb
Map the verb in the question: prevent → SCP or Control Tower guardrail. Detect or assess → Config rule, GuardDuty, Security Hub. Prove → Audit Manager evidence or Artifact reports. Choosing a detector when the question says "prevent" is the most common governance error.