Automating Network VPC Deployment in AWS Control Tower

ANS-C01 By islever Editorial Last updated Aug 21, 2026

Short answer

BCE Update the existing accounts with an Account Factory Customization (AFC). Select the same AFC when provisioning new accounts. Create an AWS CloudFormation template that describes the infrastructure that needs to be created in each account. Upload the template as an AWS Service Catalog product to the shared services account. Create an AWSControlTowerBiueprintAccess role in the shared services account.

Question

A network engineer is working on a large migration effort from an on-premises data center to an AWS Control Tower based multi-account environment. The environment has a transit gateway that is deployed to a central network services account. The central network services account has been shared with an organization in AWS Organizations through AWS Resource Access Manager (AWS RAM). A shared services account also exists in the environment. The shared services account hosts workloads that need to be shared with the entire organization. The network engineer needs to create a solution to automate the deployment of common network components across the environment. The solution must provision a VPC for application workloads to each new and existing member account. The VPCs must be connected to the transit gateway in the central network services account. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)

Deploy an AWS Lambda function to the shared services account. Program the Lambda function to assume a role in the new and existing member accounts to provision the necessary network infrastructure.
Update the existing accounts with an Account Factory Customization (AFC). Select the same AFC when provisioning new accounts. Correct Answer
Create an AWS CloudFormation template that describes the infrastructure that needs to be created in each account. Upload the template as an AWS Service Catalog product to the shared services account. Correct Answer
Deploy an Amazon EventBridge rule on a default event bus in the shared services account. Configure the EventBridge rule to react to AWS Control Tower CreateManagedAccount lifecycle events and to invoke the AWS Lambda function.
Create an AWSControlTowerBiueprintAccess role in the shared services account. Correct Answer

Key Takeaways

The exam tests knowledge of native AWS Control Tower automation features; the trap is choosing manual Lambda scripting instead of declarative infrastructure-as-code tools like Service Catalog integrated with AFC.

This question tests the integration of AWS Control Tower, Service Catalog, and EventBridge for automated resource provisioning. The community consensus identifies using Account Factory Customizations (AFC) combined with Service Catalog as the lowest overhead solution.

Common mistake: Candidates often select ACD (Lambda/EventBridge/Role), assuming custom code is required. However, this introduces significant operational overhead compared to managed services like Service Catalog and AFC.

Expert Analysis

Why the Answer Is Correct

BCE represents the most streamlined approach by leveraging AWS Control Tower's native capabilities. Option B uses Account Factory Customization (AFC) to pre-define network configurations (VPCs, TGW attachments) that are automatically applied when new accounts are created or existing ones are customized. Option C utilizes AWS Service Catalog, which allows the administrator to manage the CloudFormation template centrally in the shared services account, ensuring standardized deployment across member accounts.

Why the Other Options Are Wrong

Option A suggests using a Lambda function to assume roles and provision resources manually. While functional, this requires extensive custom coding, error handling, and maintenance, violating the 'least operational overhead' requirement. Option D is incorrect because while EventBridge can trigger actions, it is not needed if AFC handles the provisioning natively during account creation. Option E is insufficient on its own as it only creates a role without defining the actual infrastructure deployment mechanism.

Community Comment Notes

Several commenters initially favored ACD, believing custom automation was necessary. However, experienced users clarified that BCE leverages built-in Control Tower features, reducing the need for custom scripts. One comment explicitly stated, "this is BCE," highlighting the efficiency of using native tools over custom Lambda solutions.

Official Reference

https://docs.aws.amazon.com/controltower/latest/userguide/customize.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Prioritize native AWS managed services (like Service Catalog and Control Tower features) over custom Lambda implementations when the requirement specifies 'least operational overhead.' Look for combinations that use declarative templates (CloudFormation) paired with automation triggers (EventBridge/AFC).

Community Votes

BCE

80%

ACD

20%

80% of anonymous learners picked answer BCE. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

AzureDP900 👍 1

BCE (Create an AWS CloudFormation template, Deploy an Amazon EventBridge rule, and Update the existing accounts with an Account Factory Customization) is actually a more efficient and streamlined approach.
Rollizo 👍 1

For me you have to use Cloudformation, later event Bridge and Lambda Function
aragon_saa 👍 2

Answer is BCE
cas_tori 👍 1

this is BCE

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide