mission-finops --aws-governance-fit
AWS Governance Fit Assessment
Describe the estate, the operating model, and the account-delivery needs. Get a governance recommendation, an account-vending path, and a reference architecture, computed separately. The recommendation can be to do nothing yet: this tool is built to reach that answer as readily as any other.
Runs entirely in your browser, including the reference-architecture diagram. Your answers are not uploaded or stored.
Methodology and sources
Built from AWS's own Control Tower, Landing Zone, Account Factory for Terraform, and Landing Zone Accelerator documentation. Verified against:
- AWS multi-account landing zone overview
- Landing Zone 4.0 migration guide
- Extending governance in Control Tower
- Working with existing Config resources
- How Control Tower controls work
- Methods of account provisioning
- Account Factory for Terraform overview
- AFT pricing
- Account Factory Customization (AFC)
- Create a customized account from a blueprint (AFC)
- Single-Region Terraform support for Account Factory
- Automate account provisioning with Service Catalog APIs
- Service Catalog: ProvisionProduct API
- Service Catalog: UpdateProvisionedProduct API
- Control Tower pricing
- Update and move Account Factory accounts
- Unenroll an account through Service Catalog
- Close an Account Factory account
- AWS Organizations: CloseAccount API
- Control Tower in AWS GovCloud (US)
- Landing Zone Accelerator on AWS: solution overview
- LZA prerequisites (Control Tower or Organizations-only)
- LZA deployment options
- LZA cost estimate
- AWS account vending via ServiceNow and AFT
- terraform-aws-control_tower_account_factory releases
- Community-reported AFT caveat: opaque error on a failed Control Tower account creation
- Organizing your AWS environment using multiple accounts
- Design principles for your multi-account strategy
- Recommended OUs and accounts
- When multiple AWS Organizations are justified
- Best practices for the AWS Organizations management account
- Plan your AWS Control Tower landing zone
- AWS Security Reference Architecture: dedicated accounts
- AWS-published Service Control Policy examples
- AWS-published Resource Control Policy examples
- AWS-published data-perimeter policy examples
- Manage AWS Organizations policies as code
- Resource control policies (RCPs)
- AWS Organizations: higher SCP quotas (May 2026)
- AWS Control Tower: limitations and quotas
- AWS Support plan pricing
- Developer, Business, and Enterprise On-Ramp end of support
- AWS Security Hub pricing
- Security Hub CSPM's service-linked Config recorder
- AWS Config pricing
- AWS Pricing Calculator
- AWS Security Hub Cost Estimator
Last reviewed: August 31, 2026
Independent educational guidance from Mission FinOps. Not affiliated with or endorsed by Amazon Web Services. This is not a security, compliance or certification determination.