AWS Control Tower orchestrates Organizations + CloudFormation + Config. Preventive controls (SCPs), detective controls (Config rules). Landing Zones establish baseline secure accounts. Enroll existing accounts automatically.
Compliance automation: Config Rules evaluate configuration continuously. Config Remediation runs Lambda/SSM on violations. EventBridge workflows automate responses. Template libraries (stacksets).