Study guide
Technical reference and lesson notes
Purpose of This Lesson
AWS Control Tower is important for the SAP-C02 exam because it represents AWS’s managed approach to building and governing a multi-account AWS environment.
At the Solutions Architect Professional level, you need to understand when to use AWS Organizations by itself versus when to use AWS Control Tower to establish a governed landing zone with centralized logging, account structure, identity integration, and guardrails.
The key idea is this:
AWS Organizations gives you the raw multi-account management framework. AWS Control Tower builds on top of Organizations and automates a secure, well-architected multi-account baseline.
Key Concepts
AWS Organizations vs. AWS Control Tower
AWS Organizations is the foundation for managing multiple AWS accounts under a single organization. It provides:
- Consolidated billing
- Organizational Units, or OUs
- Service Control Policies, or SCPs
- Tag policies
- Backup policies
- Central account hierarchy management
AWS Control Tower extends AWS Organizations by providing a managed landing zone. It does not replace Organizations. Instead, it uses Organizations underneath and adds governance, automation, and account provisioning features.
Think of it like this:
| Service | Main Purpose |
|---|---|
| AWS Organizations | Multi-account structure, billing, OUs, and policies |
| AWS Control Tower | Automated landing zone, governance baseline, centralized logging, guardrails, and account factory |
With Organizations alone, you can manually build a similar account structure, but you are responsible for designing and configuring everything yourself.
With Control Tower, AWS gives you a starting architecture based on multi-account best practices.
What Is a Landing Zone?
A landing zone is a preconfigured, well-architected multi-account AWS environment.
In AWS Control Tower, the landing zone includes a baseline account structure, security controls, logging, audit capabilities, and identity integration.
A typical Control Tower landing zone includes:
- Management account
- Log archive account
- Audit account
- Security-related OUs
- Sandbox OU
- Production OU
- Preventive guardrails
- Detective guardrails
- IAM Identity Center integration
- Centralized logging
- Account Factory for creating new accounts
The main purpose of the landing zone is to give an organization a secure starting point instead of forcing teams to design multi-account governance from scratch.
Shared Accounts in AWS Control Tower
Management Account
The management account is the root account of the AWS Organization. It is used to launch and administer AWS Control Tower.
Important exam point:
SCPs do not restrict users or roles in the management account.
This is the same behavior as AWS Organizations. SCPs apply to member accounts, not the management account itself.
Because of this, the management account should be treated as highly sensitive. In a real environment, workloads should generally not run there. It should be reserved for organization-level administration, billing, Control Tower administration, and related governance tasks.
Log Archive Account
The log archive account is used to centrally store logs from accounts in the landing zone.
This commonly includes copies of:
- AWS CloudTrail logs
- AWS Config data
- Other governance and audit-related logs
The goal is to protect audit evidence from being modified or deleted by administrators in individual workload accounts.
For the exam, remember that centralized logging is a major reason to use Control Tower. It helps enforce separation of duties because workload account administrators should not be able to tamper with organization-wide audit logs.
Audit Account
The audit account provides centralized security and compliance visibility across the landing zone.
This account is used by security, audit, or compliance teams to review activity and validate that AWS accounts are following required policies.
The audit account supports governance by helping teams monitor activity and identify noncompliant configurations across the environment.
Guardrails in AWS Control Tower
AWS Control Tower uses guardrails to enforce and monitor governance requirements.
There are two major types:
| Guardrail Type | Enforcement Style | AWS Services Involved | Purpose |
|---|---|---|---|
| Preventive guardrails | Stop actions before they happen | Service Control Policies | Prevent policy violations |
| Detective guardrails | Detect and report violations after they happen | AWS Config, AWS Config Rules, Lambda | Identify noncompliant resources |
Preventive Guardrails
Preventive guardrails are designed to stop users from performing actions that violate governance or security policies.
They are implemented using Service Control Policies, or SCPs.
SCPs define the maximum available permissions in an AWS account. They do not grant access by themselves. Instead, they limit what IAM users, groups, and roles can do inside member accounts.
Example preventive guardrails include:
- Disallow deletion of CloudTrail logs
- Disallow deletion of S3 logging buckets
- Block public read access to S3 buckets
- Require encryption for EBS volumes
- Disallow SSH or RDP access from
0.0.0.0/0
Important distinction:
An IAM policy might allow an action, but if an SCP blocks that action, the user still cannot perform it.
SCPs are especially important in multi-account environments because they let central cloud governance teams enforce boundaries across many accounts.
Detective Guardrails
Detective guardrails do not stop the action from happening upfront. Instead, they detect and report noncompliant configurations after they exist.
Detective guardrails are typically based on:
- AWS Config
- AWS Config Rules
- Lambda functions for evaluation or remediation
Example detective guardrails include:
- Detecting publicly accessible S3 buckets
- Detecting S3 buckets without versioning
- Detecting RDS instances without encryption
- Detecting IAM policies that grant overly broad permissions
For the exam, remember the difference:
Preventive guardrails block. Detective guardrails monitor, report, and can support remediation.
IAM Identity Center Integration
AWS Control Tower integrates with IAM Identity Center to provide centralized access management across accounts.
Directory sources can include:
- IAM Identity Center directory
- External SAML 2.0 identity provider
- Microsoft Active Directory
This matters because multi-account environments need a scalable identity model. Without centralized identity, each account could become an isolated permission island with separate users, inconsistent permissions, and higher operational overhead.
For SAP-C02 scenarios, IAM Identity Center is usually the preferred option when the question involves federated access across multiple AWS accounts.
Account Factory
AWS Control Tower includes Account Factory, which automates AWS account creation.
Instead of manually creating each new account and configuring baseline security, logging, and governance settings, Account Factory helps provision accounts consistently.
This is important for organizations that need to create accounts for:
- Application teams
- Development environments
- Test environments
- Production workloads
- Sandbox environments
- Business units
- Security isolation boundaries
The exam may describe a company that needs repeatable account creation with standardized governance. That is a strong signal for AWS Control Tower and Account Factory.
Exam-Relevant Takeaways
For SAP-C02, focus on these points:
AWS Control Tower is used to create and manage a governed multi-account landing zone.
AWS Organizations is the foundation underneath Control Tower.
Control Tower adds automation, centralized logging, IAM Identity Center integration, Account Factory, and guardrails.
Preventive guardrails use SCPs to block actions before they happen.
Detective guardrails use AWS Config to detect noncompliant resources after they exist.
SCPs limit the maximum permissions available in member accounts, but they do not grant permissions.
SCPs do not restrict the management account.
The log archive account centrally stores CloudTrail and AWS Config logs.
The audit account supports centralized compliance and security visibility.
Use AWS Control Tower when the scenario requires a best-practice, multi-account baseline with governance already built in.
Use AWS Organizations alone when the requirement is primarily consolidated billing, OU structure, and policy management without needing the full managed landing zone experience.
Architecture Decision Guide
| Scenario | Best AWS Choice | Why |
|---|---|---|
| A company needs consolidated billing and basic multi-account management | AWS Organizations | Organizations provides account hierarchy, consolidated billing, OUs, and policies |
| A company wants a secure multi-account baseline with logging, audit, identity, and guardrails | AWS Control Tower | Control Tower automates a governed landing zone using AWS best practices |
| A company wants to prevent users from disabling CloudTrail across member accounts | Preventive guardrail using SCPs | SCPs can block API actions even if IAM permissions allow them |
| A company wants to detect public S3 buckets after they are created | Detective guardrail using AWS Config | AWS Config can evaluate resource configuration and report noncompliance |
| A company needs repeatable AWS account provisioning with standard baselines | AWS Control Tower Account Factory | Account Factory automates consistent account creation |
| A company needs federated access across many AWS accounts | IAM Identity Center with Control Tower | Centralized identity is easier to manage than separate IAM users in each account |
| A company wants to restrict actions in the management account using SCPs | Not possible with SCPs | SCPs do not apply to the management account |
| A company wants to centrally retain audit logs from all accounts | Log archive account | Separates log storage from workload accounts to protect audit evidence |
Common Exam Traps
Trap 1: Thinking SCPs Grant Permissions
SCPs do not grant permissions.
They only define the maximum permissions that can be used in an account. A user or role still needs IAM permissions to perform actions.
Correct mental model:
IAM allows the action.
SCP determines whether that action is even available in the account.
Trap 2: Thinking SCPs Apply to the Management Account
SCPs do not restrict the management account.
If an answer choice suggests using SCPs to restrict the root user or IAM administrator in the management account, that is likely incorrect.
Trap 3: Confusing Preventive and Detective Guardrails
Preventive guardrails block actions before they occur.
Detective guardrails identify violations after they occur.
If the question says “prevent users from deleting logs,” think SCP or preventive guardrail.
If the question says “detect whether resources are encrypted,” think AWS Config or detective guardrail.
Trap 4: Choosing Organizations When the Scenario Needs a Full Landing Zone
AWS Organizations can manage accounts, OUs, billing, and policies.
But if the scenario asks for a secure, best-practice, multi-account baseline with centralized logging, audit accounts, identity integration, and automated account provisioning, AWS Control Tower is the better answer.
Trap 5: Assuming Workload Account Admins Should Control Logging
In a well-governed multi-account architecture, workload account administrators should not be able to delete or disable centralized audit logs.
Control Tower helps separate workload administration from security and audit logging.
Trap 6: Missing the Role of AWS Config
AWS Config is central to detective controls.
If the question involves evaluating whether resources comply with required configurations, AWS Config is usually involved.
Real-World Engineer Notes
In a real AWS environment, Control Tower is valuable because it helps prevent account sprawl from turning into a governance problem.
Without a landing zone, teams may create AWS accounts inconsistently. One account may have CloudTrail enabled, another may not. One may allow public S3 buckets, another may block them. One may use IAM users, while another uses federation. Over time, that becomes difficult to secure, audit, and troubleshoot.
Control Tower gives cloud teams a standard starting point. That matters for:
- Security governance
- Compliance evidence
- Centralized logging
- Repeatable account creation
- Separation of duties
- Reduced manual configuration
- Faster onboarding of application teams
From an operations perspective, the management account should be protected heavily. Use MFA, minimize access, avoid running workloads there, and treat it as a control-plane account.
The log archive account is also critical. If an attacker compromises a workload account, centralized log copies can help preserve evidence. This is especially important for incident response.
The audit account is useful for security teams that need visibility without owning every workload account.
In enterprise environments, Account Factory can help standardize account creation. Instead of every project team requesting a manually created AWS account, a cloud platform team can create a governed provisioning process.
A practical design pattern is:
- Management account for organization administration
- Log archive account for immutable or protected logging
- Audit/security account for visibility and compliance
- Separate OUs for production, non-production, sandbox, and security
- SCPs to enforce non-negotiable rules
- AWS Config for continuous compliance monitoring
- IAM Identity Center for centralized access
Quick Reference Summary
AWS Control Tower creates a governed AWS landing zone.
It builds on top of AWS Organizations.
AWS Organizations provides multi-account structure, OUs, billing, and policies.
Control Tower adds landing zone automation, centralized logging, IAM Identity Center integration, guardrails, and Account Factory.
Preventive guardrails use SCPs to block actions.
Detective guardrails use AWS Config to detect noncompliance.
SCPs limit permissions but do not grant them.
SCPs do not apply to the management account.
The log archive account stores centralized CloudTrail and AWS Config logs.
The audit account supports centralized security and compliance review.
Use Control Tower when the exam scenario asks for a secure, scalable, governed multi-account AWS environment.
Flashcards
Q: What is AWS Control Tower used for?
A: AWS Control Tower is used to create and manage a governed multi-account AWS landing zone with centralized logging, identity integration, account provisioning, and guardrails.
Q: What AWS service does Control Tower build on top of?
A: AWS Organizations.
Q: What is a landing zone?
A: A well-architected multi-account AWS baseline that includes accounts, OUs, logging, security controls, identity integration, and governance settings.
Q: What is the purpose of the management account?
A: It is the root account of the AWS Organization and is used to launch and administer Control Tower and organization-level services.
Q: Can SCPs restrict the AWS Organizations management account?
A: No. SCPs do not apply to the management account.
Q: What is the purpose of the log archive account?
A: It centrally stores audit and configuration logs, such as CloudTrail and AWS Config logs, from accounts in the landing zone.
Q: What is the purpose of the audit account?
A: It provides centralized security and compliance visibility across the AWS environment.
Q: What AWS mechanism is used for preventive guardrails?
A: Service Control Policies, or SCPs.
Q: What AWS service is commonly used for detective guardrails?
A: AWS Config.
Q: What is the difference between preventive and detective guardrails?
A: Preventive guardrails block noncompliant actions before they happen. Detective guardrails detect and report noncompliant configurations after they exist.
Q: Do SCPs grant permissions?
A: No. SCPs only define the maximum available permissions. IAM policies are still required to grant permissions.
Q: What is Account Factory used for?
A: Account Factory automates the creation of new AWS accounts with standardized governance baselines.
Q: Why is IAM Identity Center important in Control Tower?
A: It provides centralized federated access across multiple AWS accounts.
Q: When should you choose Control Tower over Organizations alone?
A: Choose Control Tower when you need a managed landing zone with centralized logging, identity integration, governance controls, and automated account provisioning.
Q: What is a common example of a preventive guardrail?
A: Blocking deletion of CloudTrail logs or preventing public S3 bucket access.
Practice Questions
Question 1:
A company is building a new AWS environment and wants a best-practice multi-account structure with centralized logging, audit capabilities, federated access, and automated account creation. Which service should they use?
A. AWS IAM
B. AWS Control Tower
C. AWS Config only
D. AWS CloudFormation StackSets only
Correct Answer:
B. AWS Control Tower
Explanation:
AWS Control Tower provides a managed landing zone that includes account structure, centralized logging, IAM Identity Center integration, guardrails, and Account Factory for automated account provisioning.
Question 2:
A security team wants to prevent administrators in workload accounts from deleting CloudTrail logs. Which Control Tower capability is most appropriate?
A. Detective guardrail using AWS Config
B. Preventive guardrail using SCPs
C. IAM access key rotation
D. VPC Flow Logs
Correct Answer:
B. Preventive guardrail using SCPs
Explanation:
Preventive guardrails use SCPs to block actions before they occur. Deleting CloudTrail logs can be blocked with an SCP-based preventive control.
Question 3:
A company wants to detect whether RDS instances across its AWS accounts are encrypted. Which type of guardrail is most appropriate?
A. Preventive guardrail using SCPs
B. Detective guardrail using AWS Config
C. IAM permission boundary
D. AWS Organizations consolidated billing
Correct Answer:
B. Detective guardrail using AWS Config
Explanation:
Detective guardrails monitor and report on noncompliant resources. AWS Config can evaluate whether resources such as RDS instances meet required configuration rules.
Question 4:
An engineer attaches an SCP to an OU that denies a specific EC2 API action. A user in a member account has an IAM policy allowing that same action. What happens?
A. The user can perform the action because IAM allows it
B. The user can perform the action only if they are an administrator
C. The user cannot perform the action because the SCP sets the maximum available permissions
D. The user can perform the action if MFA is enabled
Correct Answer:
C. The user cannot perform the action because the SCP sets the maximum available permissions
Explanation:
SCPs do not grant permissions, but they do define the maximum permissions available in member accounts. If an SCP denies an action, IAM cannot override it.
Question 5:
A solutions architect wants to restrict what users in the AWS Organizations management account can do by applying an SCP to the root. Will this work?
A. Yes, SCPs apply to all accounts including the management account
B. Yes, but only for IAM users, not the root user
C. No, SCPs do not restrict the management account
D. No, SCPs only apply to AWS Config rules
Correct Answer:
C. No, SCPs do not restrict the management account
Explanation:
SCPs apply to member accounts in AWS Organizations, but they do not restrict the management account. The management account must be protected using other security practices such as MFA, least privilege IAM, and limited administrative access.