Automating Network VPC Deployment in AWS Control Tower
A network engineer is working on a large migration effort from an on-premises data center to an AWS Control Tower based multi-account environment. The environment has a transit gateway that is deployed to a central network services account. The central network services account has been shared with an organization in AWS Organizations through AWS Resource Access Manager (AWS RAM). A shared services account also exists in the environment. The shared services account hosts workloads that need to be shared with the entire organization. The network engineer needs to create a solution to automate the deployment of common network components across the environment. The solution must provision a VPC for application workloads to each new and existing member account. The VPCs must be connected to the transit gateway in the central network services account. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)
Community Votes
80% of anonymous learners picked answer BCE. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests knowledge of native AWS Control Tower automation features; the trap is choosing manual Lambda scripting instead of declarative infrastructure-as-code tools like Service Catalog integrated with AFC.
This question tests the integration of AWS Control Tower, Service Catalog, and EventBridge for automated resource provisioning. The community consensus identifies using Account Factory Customizations (AFC) combined with Service Catalog as the lowest overhead solution.
Candidates often select ACD (Lambda/EventBridge/Role), assuming custom code is required. However, this introduces significant operational overhead compared to managed services like Service Catalog and AFC.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
BCE represents the most streamlined approach by leveraging AWS Control Tower's native capabilities. Option B uses Account Factory Customization (AFC) to pre-define network configurations (VPCs, TGW attachments) that are automatically applied when new accounts are created or existing ones are customized. Option C utilizes AWS Service Catalog, which allows the administrator to manage the CloudFormation template centrally in the shared services account, ensuring standardized deployment across member accounts.Why the Other Options Are Wrong
Option A suggests using a Lambda function to assume roles and provision resources manually. While functional, this requires extensive custom coding, error handling, and maintenance, violating the 'least operational overhead' requirement. Option D is incorrect because while EventBridge can trigger actions, it is not needed if AFC handles the provisioning natively during account creation. Option E is insufficient on its own as it only creates a role without defining the actual infrastructure deployment mechanism.Community Comment Notes
Several commenters initially favored ACD, believing custom automation was necessary. However, experienced users clarified that BCE leverages built-in Control Tower features, reducing the need for custom scripts. One comment explicitly stated, "this is BCE," highlighting the efficiency of using native tools over custom Lambda solutions.Official Reference
Exam Strategy
Prioritize native AWS managed services (like Service Catalog and Control Tower features) over custom Lambda implementations when the requirement specifies 'least operational overhead.' Look for combinations that use declarative templates (CloudFormation) paired with automation triggers (EventBridge/AFC).
Related Analysis
Practice All ANS-C01 Questions
Access 137 questions with complete answers and detailed explanations.
View Full ANS-C01 Practice Test →