A large company is migrating ils entire IT portfolio to AWS. Each business unit in the company has a standalone AWS account that supports both…

This scenario requires a solution for centralized billing, cost allocation, and centralized security controls across multiple AWS accounts with the least effort. AWS Organizations is the service designed specifically for these purposes. First, creating an organization from a payer account and inviting existing accounts (Option B) establishes the foundational structure. This immediately enables consolidated billing, which satisfies the finance department's need for a centralized payment method. Cost visibility per account is inherently maintained. Second, enabling all features and using Service Control Policies (SCPs) (Option D) provides the centralized security control required by the security team. SCPs act as guardrails, allowing central administrators to define permission boundaries for all IAM principals in member accounts, which is the most efficient way to enforce controls across the entire organization.

A. Using CloudFormation templates is a decentralized approach that relies on individual account owners for deployment and compliance, failing the "centralized mechanism" and "least effort" requirements.
C. This option fails to address the requirements for centralized payment and centralized IAM control, focusing only on cost visibility through tagging.
E. Consolidating into a single account is a security anti-pattern that increases blast radius. It is also a massive migration effort, contradicting the "least effort" requirement.

1. AWS Organizations User Guide, "Consolidated billing for AWS Organizations": "With consolidated billing, you can see a combined view of AWS charges incurred by all of your accounts. You also can get a cost report for each member account." This supports the centralized payment and cost visibility aspect of Option B.

2. AWS Organizations User Guide, "Service control policies (SCPs)": "SCPs are a type of organization policy that you can use to manage permissions in your organization. SCPs offer central control over the maximum available permissions for all accounts in your organization." This directly supports the centralized IAM control requirement in Option D.

3. AWS Well-Architected Framework, Security Pillar, "SEC 03: How do you manage identities for people and machines?": "We recommend that you use AWS Organizations to implement control policies. For example, you can use service control policies (SCPs) to centrally control the AWS services that principals (including the root user) can access in an account." This highlights SCPs as the best practice for centralized control.

4. AWS Organizations User Guide, "Creating and managing an organization": This section details the process of creating an organization and inviting existing accounts to join, confirming the low-effort nature of the setup described in Option B.