AWS Control Tower is great to set all of this up. It's basically a layer on top of AWS SSO, AWS Org, Cloudtrail, AWS Config. With some sane default security policies.
Control Tower is cool if the problem is “I need lots of AWS accounts.” Substrate [1] is cool if the problem is “I need to accomplish something and I’m cool with using lots of AWS accounts to do it.”