A company uses AWS Organizations (all features enabled). The company requires auditing of all API calls and logins in every existing and new AWS account, wants a managed solution with minimal extra work and cost, and needs to be notified when any account is noncompliant with the AWS Foundational Security Best Practices (FSBP) standard. Which solution provides this with the least operational overhead?

AWS Control Tower provides a managed landing zone that automatically sets up a multi-account AWS environment with best practices for security and governance, including centralized logging via AWS CloudTrail and security baselines. Deploying it in the Organizations management account allows it to govern all existing and new accounts. Enabling AWS Security Hub within Control Tower centralizes security findings and automatically checks for compliance with standards like FSBP, notifying of non-compliance. Control Tower Account Factory ensures new accounts adhere to these standards from creation. This approach offers the least operational overhead because Control Tower is a fully managed service designed for this exact purpose. The other options are incorrect because: Deploying Control Tower in a member account is not the standard or recommended practice and limits its ability to govern the entire organization effectively. AWS Managed Services (AMS) Accelerate is a higher-cost, more comprehensive managed service for enterprise operations, not primarily focused on building a foundational landing zone with minimal overhead for this specific requirement. It also involves RFCs for provisioning, which adds operational overhead compared to Control Tower's automated setup.