A solutions architect is designing a multi-account AWS solution using AWS Organizations and has arranged accounts into organizational units (OUs). The architect needs to detect any changes to the OU hierarchy and notify the operations team of those changes with the LEAST operational overhead. Which solution meets these requirements?

The correct answer is to provision accounts with AWS Control Tower and use its account drift notifications. Control Tower is designed for multi-account environments and automatically detects and notifies about changes to the OU structure, providing the least operational overhead. Provisioning accounts with Control Tower and using AWS Config aggregated rules is incorrect because Config rules are primarily for resource compliance, not specifically for OU hierarchy changes within Control Tower, and would require more setup. Using AWS Service Catalog to create accounts and an AWS CloudTrail organization trail is incorrect. While CloudTrail can log changes, parsing these logs for specific OU hierarchy changes and setting up notifications would require significant custom development and operational overhead. Using AWS CloudFormation templates to create accounts and then using drift detection on a stack is incorrect. CloudFormation drift detection is for changes to resources managed by a specific stack, not for detecting changes to the overall AWS Organizations OU structure that might occur outside of a CloudFormation stack's direct management.