AWS Control Tower
Setting up and governing a multi-account AWS environment: the landing zone and its OUs and shared accounts, preventive, detective, and proactive controls and how each is implemented, Account Factory and AFT, drift detection, the dashboard, landing zone 4.0 changes, and how Control Tower relates to Organizations.
5 min read · Last reviewed · SAA-C03
Loading your progress
Sign in to bookmark tutorials and track what you have read.
On this page
What it is
AWS Control Tower offers a straightforward way to set up and govern a multi-account AWS environment that follows prescriptive best practices. It orchestrates other services, including AWS Organizations, AWS Service Catalog, and IAM Identity Center, to build a landing zone in less than an hour, and it manages those resources for you.
Choose Control Tower when a question asks for the quickest way to set up a secure, well-architected multi-account environment, to apply guardrails across many accounts with little effort, or to let teams provision new accounts that are compliant from the start. If you only need to group accounts and write SCP (Service control policy)An AWS Organizations policy that sets the maximum permissions for IAM users and roles in member accounts. It grants nothing by itself, and it does not apply to the management account.Glossary entry yourself, AWS Organizations alone is enough.
Concepts
- Landing zone: a well-architected, multi-account environment based on security and compliance best practices. It holds your OU (Organizational unit)A group of AWS accounts inside an organization in AWS Organizations. OUs can contain other OUs, and policies attached to an OU, such as SCPs, apply to every account in it.Glossary entry, accounts, users, and other resources.
- Structure:
- The root holds all OUs.
- A Security OU holds the Log Archive account (central CloudTrail and Config logs) and the Audit account (a restricted account that gives security and compliance teams access to review all accounts). These are the shared accounts.
- An optional Sandbox OU holds accounts for experimentation.
- In landing zone version 4.0, a Security OU is no longer required, and you can define your own organizational structure.
- Controls (also called guardrails): high-level rules, expressed in plain language, applied to an entire OU and every account in it.
| Control type | What it does | Implemented with |
|---|---|---|
| Preventive | Stops actions from happening | SCPs and RCP (Resource control policy)An AWS Organizations policy that sets the maximum permissions on resources in member accounts, such as S3 buckets and KMS keys, whoever requests access. Like an SCP, it grants nothing by itself.Glossary entry |
| Detective | Detects noncompliant resources after the fact | AWS Config rules |
| Proactive | Checks resources before they are provisioned | CloudFormation hooks |
Controls are also grouped by guidance: mandatory, strongly recommended, or elective.
- Account Factory: a configurable account template that standardizes how new accounts are provisioned, with pre-approved configurations. Account Factory for Terraform (AFT) provisions and customizes accounts through a Terraform pipeline.
- Dashboard: a continuous view of accounts, enabled controls, and noncompliant resources.
- Drift detection: finds changes made outside Control Tower that break the landing zone's best-practice setup, so administrators can repair them.
- Existing organizations: you can set up a landing zone in an existing AWS Organizations organization. Registering an existing OU enrolls its accounts, so the landing zone baseline and the OU's controls apply without recreating accounts or moving workloads. You can also enroll existing accounts one at a time.
Security, resilience, performance, and cost
Security
- Mandatory controls protect the landing zone itself, for example by keeping logging and cross-account access in place.
- All activity, including in the management account, is logged to the Log Archive account.
- The root user and administrators in the management account can do things that controls would otherwise deny. This exception is intentional, so restrict access to that account.
Resilience
- Separate workloads into accounts and OUs, and enable the same controls everywhere, so every new account starts compliant.
Cost
- Control Tower has no separate charge. You pay for the services it sets up, such as AWS Config, CloudTrail, and S3 storage for logs.
Monitoring
- Use the dashboard for compliance, and Config and CloudTrail data in the Log Archive and Audit accounts for investigations.
Control Tower or another option?
| If the requirement is | Choose |
|---|---|
| Set up a governed multi-account landing zone quickly | AWS Control Tower |
| Provision new compliant accounts on demand | Control Tower Account Factory |
| Govern accounts in an organization we already have | Set up Control Tower in it, and register the existing OUs |
| Provision accounts through Terraform | Account Factory for Terraform (AFT) |
| Write and attach our own SCPs to OUs | AWS Organizations |
| Let users launch only approved products | AWS Service Catalog |
| Continuous configuration compliance in one account | AWS Config |
Reverse mindmap: when the question points here
- Yes, when the question says
- Set up a multi-account environment following best practices leads to Control Tower
- Landing zone with least effort leads to Control Tower
- Guardrails across all accounts leads to Control Tower controls
- New accounts compliant from day one leads to Account Factory
- Bring existing accounts under governance leads to Register the existing OU
- Know the controls
- Stop an action from happening leads to Preventive control, SCP or RCP
- Find noncompliant resources leads to Detective control, Config rule
- Check resources before provisioning leads to Proactive control, CloudFormation hook
- Know the structure
- Central logs for all accounts leads to Log Archive account
- Security team reviews all accounts leads to Audit account
- Manual changes break the setup leads to Drift detection
- No, when the question says
- Just group accounts and write SCPs leads to Organizations
Key takeaways
- Control Tower sets up and governs a multi-account landing zone, orchestrating Organizations, Service Catalog, and IAM Identity Center.
- Controls apply to whole OUs: preventive (SCPs and RCPs), detective (Config rules), and proactive (CloudFormation hooks).
- Account Factory standardizes new accounts; AFT does it with Terraform.
- The Log Archive and Audit accounts centralize logs and security tooling; landing zone 4.0 no longer requires a Security OU.
- Drift detection finds changes made outside Control Tower.
Sources
- AWS Control Tower User Guide: What is AWS Control Tower?
- AWS Control Tower User Guide: How AWS Control Tower works
- AWS Control Tower User Guide: About AWS accounts in AWS Control Tower
- AWS Control Tower User Guide: What are the shared accounts?
- AWS Control Tower User Guide: Resources created in the service integration accounts
- AWS Control Tower User Guide: AWS multi-account strategy for your landing zone
- AWS Control Tower Controls Reference Guide: About controls
- AWS Control Tower User Guide: How controls work
- AWS Control Tower User Guide: The AWS Control Tower Control Catalog
- AWS Control Tower User Guide: Provision and manage accounts with Account Factory
- AWS Control Tower User Guide: Overview of Account Factory for Terraform (AFT)
- AWS Control Tower User Guide: Register an existing organizational unit with AWS Control Tower
- AWS Control Tower User Guide: About enrolling existing accounts
- AWS Control Tower User Guide: Detect and resolve drift
- AWS Control Tower pricing