AWS Account Vending

This report outlines how organizations can scale AWS multi-account environments by pairing a Landing Zone (e.g., AWS Control Tower) with an account vending strategy that automates setup outside the account. It covers standardizing controls (CloudTrail, SCPs, SSO, networking), enabling differentiation by environment and ownership, integrating with IaC and CI/CD (e.g., GitHub repos and actions), and establishing paved roads for common infrastructure. The guidance emphasizes enforcing policies like prod/dev isolation and PII restrictions while automating alerts and integrations so new accounts are immediately usable, secure, and compliant.