AWS Control Tower Landing Zone Setup and Governance | AWS Systems Architect Professional

Study guide

Technical reference and lesson notes

Purpose of This Lesson

This lesson covers how AWS Control Tower is used to create and manage a multi-account AWS environment through a standardized landing zone.

For the SAP-C02 exam, this matters because AWS expects Solutions Architect Professional candidates to understand how to design secure, governed, scalable AWS environments. Control Tower is commonly the preferred service when an organization needs a managed multi-account foundation with guardrails, centralized logging, account vending, and federated access.

Key Concepts

AWS Control Tower Overview

AWS Control Tower provides a managed way to set up and govern a multi-account AWS environment using AWS Organizations, AWS IAM Identity Center, guardrails, organizational units, and shared accounts.

The environment created by Control Tower is called a landing zone.

A landing zone is not just a single AWS account. It is a baseline AWS environment that includes:

A management account
Foundational organizational units
Shared security and logging accounts
Guardrails for governance
Centralized access management
Account provisioning through Account Factory
Optional regional governance controls

In an enterprise AWS environment, Control Tower helps enforce a consistent account structure instead of allowing every team to build AWS accounts differently.

What a Landing Zone Includes

A Control Tower landing zone establishes the starting point for governed AWS usage.

Typical landing zone components include:

Management account – The account used to administer AWS Organizations and Control Tower.
Security OU – A foundational organizational unit that contains shared security accounts.
Log archive account – Central location for storing logs.
Audit account – Used by security and compliance teams for read-only or audit-related visibility.
Sandbox OU – Optional OU commonly used for development, testing, or experimentation.
Guardrails – Governance rules that prevent or detect risky configurations.
IAM Identity Center access – Federated access and user/group management.
Account Factory – A controlled method for provisioning new AWS accounts.

Home Region

During Control Tower setup, you select a home region.

The home region is the primary AWS Region where the landing zone is configured and managed. In the transcript example, the home region was set to US East (N. Virginia).

For the exam, remember that region selection matters because governance is not automatically applied globally to every AWS Region unless configured. You can add additional governed regions later.

Region Deny Setting

Control Tower includes a region deny option.

When enabled, this setting can restrict access to AWS Regions that are not explicitly allowed. This is useful when an organization wants to limit AWS usage to approved geographic regions for compliance, data residency, cost control, or operational reasons.

For example, a company may only allow workloads in:

us-east-1
us-east-2
us-west-2

If region deny is enabled, users and workloads can be prevented from using unapproved regions.

When Region Deny Matters

Region deny is especially important for:

Data residency requirements
Compliance frameworks
Reducing accidental resource deployment
Cost governance
Security boundary enforcement
Preventing shadow IT in unapproved regions

Exam Tip

If a scenario says the company must prevent workloads from being launched outside approved AWS Regions, Control Tower region deny or SCP-based regional restrictions are likely relevant.

Organizational Unit Structure

Control Tower creates a default AWS Organizations structure.

The foundational OU in the lesson is the Security OU. This OU contains shared security-related accounts, especially:

Log archive account
Audit account

An additional OU, such as Sandbox, can also be created. This is useful for development and testing workloads that should be separated from production or security accounts.

Shared Accounts

Control Tower uses several important accounts.

Management Account

The management account is the top-level administrative account for AWS Organizations and Control Tower.

This account should not be used for normal workloads. It should be tightly protected because compromise of the management account could impact the entire AWS Organization.

Log Archive Account

The log archive account is used to centralize logs from across the organization.

This supports:

Security investigations
Audit requirements
Compliance retention
Centralized visibility
Separation of duties

In a mature AWS environment, logs should not be scattered across workload accounts where application teams could accidentally or intentionally modify them.

Audit Account

The audit account is used for security and compliance visibility.

This account is typically where security teams, auditors, or compliance tooling can access cross-account information without needing direct administrative access to every workload account.

Unique Email Addresses for Shared Accounts

When Control Tower creates shared accounts, each account requires a unique email address.

This is a practical setup requirement that can become a real-world planning issue. Before deploying Control Tower in a production organization, you should have an email naming strategy for AWS accounts.

Common patterns include:

aws-log-archive@example.com
aws-audit@example.com
aws-security@example.com
aws-prod-network@example.com

Encryption Settings

During setup, Control Tower may provide encryption configuration options.

Encryption is important because centralized logging and audit data may contain sensitive operational and security information. In production environments, encryption should be reviewed carefully instead of casually accepting defaults.

For SAP-C02, think about encryption from a governance perspective:

Who controls the keys?
Are logs encrypted at rest?
Are KMS keys centrally managed?
Is access to audit data restricted?
Are key policies aligned with security requirements?

Guardrails

Guardrails are one of the most important Control Tower concepts.

A guardrail is a governance rule applied to accounts or OUs. Guardrails help enforce security, compliance, and operational standards.

Control Tower guardrails are generally grouped into two categories:

Preventive Guardrails

Preventive guardrails stop non-compliant actions before they happen.

These are commonly implemented using Service Control Policies, or SCPs.

Example preventive guardrail behavior:

Prevent disabling logging
Prevent changes to certain security settings
Prevent use of unapproved regions
Prevent deletion of required resources

Detective Guardrails

Detective guardrails identify non-compliant configurations after they exist.

These are commonly implemented using AWS Config rules.

Example detective guardrail behavior:

Detect whether required logging is enabled
Detect public access settings
Detect configuration drift
Detect resources that violate governance expectations

Mandatory and Elective Guardrails

Control Tower guardrails can be mandatory or optional.

Mandatory Guardrails

Mandatory guardrails are required by Control Tower and are part of the baseline governance model.

These are generally foundational controls that AWS expects to remain enabled for proper landing zone operation.

Elective Guardrails

Elective guardrails can be enabled based on organizational requirements.

For example, a company with strict compliance requirements may enable additional controls beyond the default baseline.

Account Factory

Account Factory is the Control Tower feature used to provision new AWS accounts in a standardized way.

Instead of creating accounts manually, Account Factory allows account creation with predefined governance, networking, and OU placement settings.

This helps enforce consistency across accounts.

Account Factory can define options such as:

Whether internet-accessible subnets are allowed
Number of private subnets
Regions available for provisioning
VPC-related baseline settings
Account enrollment options

Enrolling Existing Accounts

Control Tower can be used with both new and existing accounts.

There are two major account lifecycle options:

Account Type	Control Tower Action
New account	Provision through Account Factory
Existing account	Enroll into Control Tower governance

This is important for migrations. Many enterprises already have AWS accounts before adopting Control Tower. In those cases, they need to bring existing accounts under governance rather than starting from scratch.

IAM Identity Center and Federated Access

Control Tower configures federated access using AWS IAM Identity Center, formerly known as AWS Single Sign-On.

This allows centralized identity and access management across AWS accounts.

Instead of creating IAM users separately in every account, users can access assigned accounts and roles through a central access portal.

This supports:

Centralized authentication
Group-based access
Reduced IAM user sprawl
Easier onboarding and offboarding
Better governance across accounts

Landing Zone Settings

After the landing zone is created, settings can be modified.

Important post-deployment settings include:

Region deny configuration
Additional governed AWS Regions
OU structure
Guardrail enablement
Account enrollment
Account Factory settings

This matters because a landing zone is not a one-time setup. It becomes the governance foundation for the AWS environment and must evolve as the organization grows.

Marketplace for Control Tower

Control Tower includes access to marketplace solutions that integrate with the landing zone.

These can extend governance, security, compliance, or operational capabilities. For SAP-C02, the key point is not the marketplace itself, but the idea that Control Tower provides an extensible governance framework.

Viewing OU Compliance and Governance State

Within Control Tower, you can review organizational units and see governance-related information such as:

Governed accounts
Enabled guardrails
Applied SCPs
Compliance state
Non-compliant resources
Nested OUs
Accounts inside the OU

This is operationally important because Control Tower is not only used to deploy the initial environment. It is also used to monitor whether the environment remains compliant.

Exam-Relevant Takeaways

For SAP-C02, remember these points:

Control Tower is used to create and govern a secure multi-account AWS environment. The environment it creates is called a landing zone.

A landing zone includes foundational OUs, shared accounts, guardrails, centralized access, and account provisioning controls.

The management account should be protected and should not host normal workloads.

The log archive account centralizes logs for security, audit, and compliance.

The audit account provides security and compliance visibility across the organization.

Guardrails can be preventive or detective. Preventive guardrails stop actions, often through SCPs. Detective guardrails identify violations, often through AWS Config.

Region deny can be used to restrict AWS usage to approved regions.

Account Factory provides standardized account provisioning.

Existing accounts can be enrolled into Control Tower governance.

IAM Identity Center provides centralized federated access across accounts.

Control Tower is the preferred AWS-native service for setting up a governed multi-account landing zone.

Architecture Decision Guide

Scenario	Best AWS Choice	Why
A company needs a governed multi-account AWS environment	AWS Control Tower	Provides a managed landing zone with OUs, guardrails, shared accounts, and account provisioning
A company needs centralized account creation with standard settings	Control Tower Account Factory	Provisions accounts consistently with predefined governance and network options
A company needs to centralize logs from many AWS accounts	Log archive account	Separates log storage from workload accounts and supports audit/security requirements
A security team needs visibility across AWS accounts without managing workloads	Audit account	Provides a dedicated account for security and compliance access
A company must block usage of unapproved AWS Regions	Control Tower region deny or SCPs	Prevents workloads from being deployed outside approved regions
A company wants to prevent risky actions before they happen	Preventive guardrails	Enforce restrictions using controls such as SCPs
A company wants to detect configuration violations after deployment	Detective guardrails	Uses detection mechanisms such as AWS Config rules
A company already has AWS accounts and wants to bring them under governance	Enroll accounts into Control Tower	Allows existing accounts to be governed without recreating them
A company wants centralized access to many AWS accounts	IAM Identity Center	Provides federated access and account/role assignment through a central portal

Common Exam Traps

Trap 1: Thinking Control Tower Replaces IAM

Control Tower does not replace IAM permissions.

Control Tower defines governance boundaries, but users and roles still need IAM permissions to perform actions. SCPs and guardrails can limit what is possible, but IAM still grants the actual permissions.

Trap 2: Assuming All Regions Are Governed Automatically

Control Tower starts with a selected home region and can be extended to additional regions.

Do not assume every AWS Region is governed unless the scenario says that region governance has been configured.

Trap 3: Confusing Preventive and Detective Guardrails

Preventive guardrails stop actions before they happen.

Detective guardrails identify violations after they occur.

If the question asks how to block an action, think preventive. If it asks how to monitor or detect noncompliance, think detective.

Trap 4: Using the Management Account for Workloads

The management account should be used for organization-level administration, not application workloads.

Running production workloads in the management account is poor design.

Trap 5: Manually Creating Accounts Instead of Using Account Factory

In a governed Control Tower environment, new accounts should generally be created through Account Factory so they receive the correct baseline configuration.

Trap 6: Forgetting Unique Email Requirements

Each AWS account needs a unique email address.

This is not usually the main answer on an exam question, but it matters in real-world planning.

Trap 7: Thinking Control Tower Automatically Governs Everything

Control Tower provides a baseline, but governance can be extended after setup.

Additional regions, guardrails, OUs, and account enrollments may need to be configured.

Real-World Engineer Notes

In a real enterprise AWS environment, Control Tower is often the difference between organized cloud growth and uncontrolled account sprawl.

From an infrastructure engineer’s perspective, the biggest value is standardization. Instead of every team creating accounts, VPCs, logging, and access differently, Control Tower gives the organization a repeatable baseline.

For production use, plan these items before deployment:

Account email naming convention
OU structure
Region strategy
Logging retention requirements
Security team access model
IAM Identity Center integration
Guardrail strategy
Existing account enrollment plan
Break-glass access
KMS key strategy
Network baseline strategy

The Security OU should be treated carefully. The log archive and audit accounts are high-value targets because they contain visibility into the broader AWS environment.

For governance, start with mandatory controls, then add elective guardrails based on compliance needs. Be careful with overly aggressive preventive guardrails because they can block legitimate engineering work if not tested properly.

For migrations, existing AWS accounts may need cleanup before enrollment. Accounts with nonstandard configurations, existing SCP conflicts, unmanaged IAM patterns, or noncompliant resources may require remediation before they fit cleanly into the landing zone.

In operations, Control Tower should be monitored regularly for:

Drift
Non-compliant resources
Failed guardrail enforcement
Accounts not properly enrolled
Region usage outside approved patterns
Identity Center assignment sprawl
SCP conflicts

Quick Reference Summary

AWS Control Tower creates a governed multi-account AWS environment called a landing zone.

A landing zone typically includes a management account, Security OU, log archive account, audit account, guardrails, IAM Identity Center access, and Account Factory.

The home region is the primary region for the landing zone. Additional governed regions can be added later.

Region deny can restrict AWS usage to approved regions.

Guardrails enforce governance. Preventive guardrails block actions. Detective guardrails detect violations.

Account Factory standardizes new account creation.

Existing accounts can be enrolled into Control Tower.

The management account should be protected and not used for normal workloads.

The log archive account stores centralized logs.

The audit account supports security and compliance review.

Control Tower is the AWS-native service to choose when the exam scenario requires centralized multi-account governance.

Flashcards

Q: What is an AWS Control Tower landing zone?
A: A managed multi-account AWS environment that includes foundational OUs, shared accounts, guardrails, access management, and account provisioning controls.

Q: What is the purpose of the AWS Control Tower management account?
A: It administers AWS Organizations and Control Tower. It should not be used for normal application workloads.

Q: What is the purpose of the log archive account?
A: It centralizes logs from across the AWS Organization for security, compliance, and audit purposes.

Q: What is the purpose of the audit account?
A: It provides security and compliance teams with visibility into accounts and resources across the organization.

Q: What is a preventive guardrail?
A: A governance control that blocks noncompliant actions before they occur, often using Service Control Policies.

Q: What is a detective guardrail?
A: A governance control that detects noncompliant configurations after they exist, often using AWS Config rules.

Q: What feature is used to create new AWS accounts in Control Tower?
A: Account Factory.

Q: Can Control Tower govern existing AWS accounts?
A: Yes. Existing accounts can be enrolled into Control Tower governance.

Q: What does the region deny setting help enforce?
A: It helps prevent use of AWS Regions that are not approved by the organization.

Q: What AWS service provides centralized federated access in Control Tower?
A: AWS IAM Identity Center.

Q: Why should new accounts be created through Account Factory?
A: To ensure accounts are provisioned with consistent governance, OU placement, and baseline configuration.

Q: Are IAM permissions still required when using Control Tower?
A: Yes. Control Tower sets governance boundaries, but IAM permissions are still required to perform actions.

Q: What is the Security OU used for in a Control Tower landing zone?
A: It contains foundational security-related accounts such as the log archive and audit accounts.

Q: Why is Control Tower useful for enterprise AWS environments?
A: It provides standardized governance, centralized access, account provisioning, logging, and compliance controls across multiple AWS accounts.

Practice Questions

Question 1:
A company wants to create a standardized multi-account AWS environment with centralized logging, security accounts, guardrails, and controlled account provisioning. Which AWS service should the solutions architect recommend?

A. AWS Config
B. AWS Control Tower
C. AWS CloudFormation StackSets
D. AWS Systems Manager

Correct Answer:
B. AWS Control Tower

Explanation:
AWS Control Tower is designed to create and govern a multi-account AWS environment using a landing zone, shared accounts, OUs, guardrails, IAM Identity Center, and Account Factory.

Question 2:
A company needs to prevent teams from launching resources in AWS Regions that are not approved for compliance reasons. Which Control Tower feature is most relevant?

A. Account Factory
B. Region deny setting
C. Log archive account
D. IAM access keys

Correct Answer:
B. Region deny setting

Explanation:
The region deny setting can be used to restrict access to unapproved AWS Regions. This is useful for compliance, data residency, and governance requirements.

Question 3:
A security team wants centralized access to review activity and compliance across multiple AWS accounts, but application teams should not manage this account. Which account is designed for this purpose in a Control Tower landing zone?

A. Management account
B. Audit account
C. Sandbox account
D. Workload account

Correct Answer:
B. Audit account

Explanation:
The audit account is intended for security and compliance visibility across the AWS environment. It supports separation of duties and centralized governance.

Question 4:
A company wants to detect whether resources in member accounts violate required configuration standards. The company does not need to block the action immediately, but it does need visibility into violations. What type of guardrail should be used?

A. Preventive guardrail
B. Detective guardrail
C. IAM permission boundary
D. VPC endpoint policy

Correct Answer:
B. Detective guardrail

Explanation:
Detective guardrails identify configuration violations after they occur. Preventive guardrails are used when the goal is to block actions before they happen.

Question 5:
An enterprise already has several AWS accounts and now wants to bring them under centralized Control Tower governance. What should the architect recommend?

A. Delete and recreate all accounts using the root user
B. Enroll the existing accounts into AWS Control Tower
C. Move all workloads into the management account
D. Replace AWS Organizations with IAM Identity Center

Correct Answer:
B. Enroll the existing accounts into AWS Control Tower

Explanation:
Control Tower supports enrolling existing AWS accounts so they can be governed by the landing zone without requiring all accounts to be recreated.