AWS Control Tower
AWS Control Tower is a service on Amazon Web Services that provides the rapid setup and ongoing management of a new multi-account AWS environment, built on top of AWS Organizations. It automates the creation of a landing zone with a baseline of accounts, organizational units, and guardrails so a company can start operating a well-governed multi-account structure quickly.
Key points
- Provides rapid setup and management of a new multi-account AWS environment.
- Builds on AWS Organizations to establish a baseline landing zone of accounts and organizational units.
- Applies guardrails to keep accounts compliant with organizational policy as the environment grows.
- Account Factory automates provisioning of new, standardized accounts pre-configured with baseline networking and guardrails.
- Current AWS documentation calls these guardrails controls — “guardrail” and “control” are now used synonymously during the terminology transition, with “control” being the preferred term. Controls come in three types: preventive controls (implemented as AWS Organizations SCPs, which block disallowed actions outright), detective controls (implemented as AWS Config rules that flag noncompliant resources after the fact), and proactive controls (which use CloudFormation hooks to scan resources before they are provisioned and block deployment of noncompliant configurations).
- A control applies at the organizational-unit level, so every account within that OU is subject to it; a company using plain Organizations without Control Tower must configure and maintain equivalent SCPs and Config rules manually rather than getting them applied automatically.
- The management account root user and administrators are exempt from controls, so the management account cannot be locked out of its own environment; these actions remain fully logged in the log archive account for auditing.