Which service enables centralized governance, policy enforcement, and landing zone management for multi-account environments?

• A. AWS Management Console
• B. AWS Health Dashboard
• C. AWS Config
• D. AWS Control Tower

Answer: (D)

Centralized governance across multiple AWS accounts is provided by a landing-zone management service. AWS Control Tower offers a prebuilt landing zone that works with AWS Organizations to enroll and provision accounts, and it applies guardrails—both preventive and detective—to enforce policies automatically across the whole environment. It also centralizes identity access (with SSO), consolidates logging, and provides a consistent baseline for new and existing accounts, making ongoing governance and compliance easier to manage. Because of these capabilities, it is the best fit for centralized governance, policy enforcement, and landing zone management in multi-account setups.

The other services don’t bundle those capabilities in the same way. The Management Console is just the user interface for using AWS services. The Health Dashboard shows service health events, not governance or account provisioning. AWS Config tracks configuration changes and can help with compliance, but it doesn’t by itself provide automated landing zones or centralized policy enforcement across multiple accounts.