The company manages many accounts in Organizations and wants preventive and detective controls applied now and automatically to any accounts created later. Which solution provides guardrails across current and future accounts?

AWS Control Tower is the most comprehensive solution for establishing a multi-account AWS environment with preventive and detective controls that apply to both existing and future accounts. It automates the setup of a landing zone, including AWS Organizations, and provides guardrails (preventive and detective controls) that apply across OUs. Enrolling existing accounts and provisioning new ones through Control Tower ensures consistent governance. Using AWS Organizations OUs with SCPs is a good start for preventive controls, but it doesn't inherently provide detective controls or a streamlined way to apply them to new accounts automatically without additional services. CloudFormation StackSets can deploy Config rules but require manual updates for new accounts and are primarily for detective controls, not preventive guardrails. AWS Config with organization-wide rules and conformance packs offers detective controls but doesn't provide the foundational account provisioning and preventive guardrails that Control Tower does.