Updated March 15, 2025
· ~4 min read
Every AWS environment with more than a few accounts needs a governance model. The question is whether to use AWS Control Tower, AWS's managed landing zone service, or build your own governance layer directly on AWS Organizations. This is not an either/or in the abstract; the right answer depends on your team size, existing infrastructure, and governance requirements.
AWS Control Tower is an orchestration layer over AWS Organizations, IAM Identity Center, AWS Config, CloudTrail, and Service Catalog. It enforces a specific Landing Zone structure, provides a library of 300+ guardrails, and automates account vending via Account Factory. It has strong opinions about how your AWS environment should be structured and limits some customizations.
DIY Organizations means using AWS Organizations directly — writing your own SCPs, configuring CloudTrail and Config across accounts via StackSets, building your own account vending automation (typically CodePipeline + Lambda + Terraform), and managing SSO separately. Maximum flexibility, but requires significant platform engineering investment.
The Landing Zone Accelerator (LZA) is a third option: an AWS-published open-source CDK-based solution that automates a reference landing zone on top of Organizations without the constraints of Control Tower.
Control Tower is the right choice when you want AWS to manage the governance orchestration rather than building it yourself. Three scenarios strongly favor Control Tower: teams starting a net-new multi-account environment who want a production-ready foundation without months of platform engineering; organizations that need a managed guardrail library (writing and maintaining 30+ SCPs and Config rules is non-trivial); and teams whose governance requirements align with the standard OU structure Control Tower prescribes. Account Factory for Terraform (AFT) eliminates one of the historical objections to Control Tower — that account vending was GUI-only. AFT provides GitOps-driven account provisioning with code review, making Control Tower viable for teams that require infrastructure-as-code discipline.
DIY Organizations is appropriate in specific circumstances. If you have an existing complex Organizations setup with hundreds of accounts, SCPs, and custom tooling — enrolling into Control Tower is risky and disruptive, and the migration cost rarely justifies the operational savings. If your OU structure deviates significantly from Control Tower's prescribed hierarchy, or if you need SCP configurations that Control Tower's mandatory guardrails prevent — DIY gives you the freedom. If you have a dedicated platform team with existing Terraform/CDK expertise and prefer maximum control over governance automation, DIY with a well-maintained SCP and Config rule library is a legitimate choice. The Landing Zone Accelerator is often a better middle ground than pure DIY for teams in this position.
Question 1 of 4
How many AWS accounts do you have or expect to have in the next 12 months?
For most teams with 5+ accounts who are starting from scratch or in the early stages of multi-account adoption: use Control Tower. The managed guardrail enforcement, Account Factory for Terraform (AFT) integration, and Identity Center setup provide significant value that would otherwise require months of platform engineering work. The constraints (specific OU structure, limited SCP customization without CfCT) are worth accepting for the operational savings. For teams with an existing complex Organizations setup, strong platform engineering resources, or requirements that conflict with Control Tower's opinions: evaluate carefully before migrating, as Control Tower enrollment can be disruptive to running accounts.
AWS Control Tower & Account Vending
Enterprise AWS account governance using Control Tower: automated account vending, preventive and detective guardrails, and a scalable multi-account foundation.
AWS Landing Zone Foundation
Enterprise-grade AWS account structure designed for security, scalability, and compliance from day one.
We work with startups and growing companies on AWS architecture decisions. Tell us about your situation and we will recommend the right approach.
As of March 15, 2025. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.