A regulated company is introducing a multi-account landing zone. It requires isolated log and audit accounts, governed account provisioning, and controls applied consistently as accounts grow. Which approach minimizes custom governance plumbing?

1. Replace account governance with one cross-Region S3 replication rule.
2. Create accounts manually and assume organization membership installs every security control.
3. Use AWS Control Tower with organizational units, account provisioning, and an appropriate control baseline.
4. Use one shared account for every team and separate all workloads only by Name tags.