A company deployed multiple AWS accounts with AWS Control Tower. The security team needs to automate Control Tower guardrails for all accounts in a specific OU, keep the guardrail configuration under version control with the ability to review and roll back changes, have the security team maintain the solution in its own OU, and restrict guardrail types so only approved new guardrails are allowed. Which solution provides the most operational efficiency?

This solution offers the most operational efficiency by leveraging infrastructure as code (CloudFormation) for version control and automated deployment. Storing templates in CodeCommit allows for review and rollback, meeting the version control requirement. Using AWS::ControlTower::EnableControl for each OU correctly applies guardrails at the organizational unit level, which is more efficient than per-account deployment for multiple accounts in an OU. CodePipeline automates the deployment process, triggered by CodeCommit changes via EventBridge, ensuring new guardrails are automatically applied and restricting guardrail types to only those defined in the templates. The first incorrect option is less efficient because CodeBuild alone doesn't provide the full CI/CD pipeline capabilities for managing deployments as robustly as CodePipeline. The second incorrect option requires manual pipeline starts, reducing automation and operational efficiency. The fourth incorrect option uses S3 for template storage, which lacks the native version control and collaboration features of CodeCommit, making it less suitable for managing code changes and reviews.