A DevOps engineer set up AWS Organizations and AWS Control Tower with OUs and landing zone. The organization needs a solution that automatically deploys CloudFormation templates and service control policies (SCPs) customized by OU or account whenever a user creates a new account through Control Tower Account Factory. Which approach provides the most automated deployment of the required resources to new accounts?

The Customizations for AWS Control Tower (CfCT) solution is designed precisely for this scenario. It allows you to define custom CloudFormation templates and SCPs that are automatically deployed to new accounts provisioned through Control Tower Account Factory, or to existing accounts. By using an AWS CodeCommit repository for your custom package, you ensure version control and a centralized source for your customizations. Incorrect options: Using AWS Service Catalog alone doesn't automatically deploy resources to new accounts created via Account Factory without additional automation. SCPs are also not deployed via Service Catalog. CloudFormation StackSets with automatic deployment can deploy templates, but managing SCPs separately still requires manual intervention or a different automation mechanism. An EventBridge rule detecting CreateManagedAccount is a good start for automation, but configuring Service Catalog as the target for automatic deployment of resources and SCPs to new accounts is not a native or straightforward integration for this purpose.