A company uses AWS Organizations with all features enabled and has configured AWS Control Tower and a landing zone. The company must provision multiple environment accounts and a CI/CD account, apply an initial baseline configuration to every account, and ensure Control Tower guardrails are enforced in all accounts. Which solution achieves this with the least operational overhead?

The correct answer leverages AWS Control Tower's Account Factory Customization (AFC) feature. AFC allows you to define a blueprint that includes your desired baseline configurations (e.g., CloudFormation templates, Service Catalog products) and then use Account Factory to provision new accounts based on this blueprint. This approach ensures that all new accounts are created with the baseline configuration and automatically enrolled under Control Tower governance, enforcing guardrails from inception with minimal operational overhead. Using AWS CloudFormation StackSets after account creation (second option) adds a separate step and doesn't integrate the baseline directly into the provisioning process. Creating accounts via AWS Organizations and using a Lambda function (third option) is a custom solution that requires more development and maintenance overhead compared to the native AFC feature. The fourth option also uses AWS Organizations and CloudFormation StackSets, which, while functional, is less integrated and automated than AFC for Control Tower environments.