Study guide
Technical reference and lesson notes
Purpose of This Lesson
AWS Control Tower provides a managed governance layer on top of AWS Organizations. It helps establish and operate a multi-account AWS environment using a preconfigured landing zone, centralized logging, account provisioning, federated access, and preventive and detective guardrails.
The key distinction is that Organizations provides the underlying account and policy structure, while Control Tower automates and governs a recommended multi-account baseline.
Key Concepts
AWS Organizations and Control Tower
AWS Organizations provides the foundational capabilities for managing multiple AWS accounts, including:
- Organizational units (OUs) for grouping accounts.
- Consolidated billing.
- Service control policies (SCPs) to limit the maximum permissions available in accounts.
- Tag policies and backup policies.
- Centralized organization management.
Control Tower uses Organizations and adds operational automation and governance capabilities, including:
- A preconfigured multi-account landing zone.
- Account Factory for standardized account provisioning.
- Preventive and detective guardrails.
- Centralized audit and log archive accounts.
- AWS IAM Identity Center integration for federated access.
- A baseline structure based on AWS-recommended practices.
Control Tower does not replace Organizations. It extends it. Organizations capabilities remain available underneath the Control Tower implementation.
The Control Tower Landing Zone
A landing zone is a governed, multi-account AWS foundation. Control Tower creates an initial structure that can subsequently be customized with additional OUs and accounts for development, testing, production, security, and other workloads.
The initial baseline commonly includes:
- A management account.
- A security OU containing shared governance accounts.
- A log archive account.
- An audit account.
- A sandbox OU or account for experimentation and development.
- A production OU or account.
- Guardrails applied at appropriate organizational levels.
The landing zone is a starting point rather than a complete representation of every organization’s final architecture.
Shared Accounts
#### Management account
The management account is the root of the AWS Organization and is used to launch and administer Control Tower.
The management account has special authority. SCPs do not restrict actions performed in the management account, so it requires especially strong protection, limited access, and careful operational controls.
#### Log archive account
The log archive account stores centralized copies of governance and security logs, such as:
- AWS CloudTrail logs.
- AWS Config log files.
Centralizing these logs in a dedicated account helps prevent workload account administrators from altering or deleting the authoritative audit history.
#### Audit account
The audit account aggregates and stores audit-related information collected from accounts in the landing zone. It provides a centralized location for security and compliance teams to review account activity and configuration status.
Preventive Guardrails
Preventive guardrails stop prohibited actions or configurations before they occur. They are commonly implemented with SCPs.
An SCP does not grant permissions. Instead, it limits the maximum permissions that IAM policies can provide. If an IAM policy allows an API action but an applicable SCP denies it, the action remains unavailable.
Examples include guardrails that:
- Prevent deletion of CloudTrail logs.
- Prevent deletion or modification of S3 logging destinations.
- Disallow public read access to S3 buckets.
- Require encryption for Amazon EBS volumes.
- Prevent unrestricted SSH or RDP access from
0.0.0.0/0.
Detective Guardrails
Detective guardrails identify policy violations or noncompliant resources after they exist. They are typically implemented using AWS Config rules and related remediation mechanisms.
Examples include detecting:
- Publicly accessible S3 buckets.
- S3 buckets without versioning enabled.
- Amazon RDS instances without encryption enabled.
- IAM policies that grant overly broad permissions.
Detective controls report or flag a violation; they do not provide the same immediate prevention as an SCP-based preventive guardrail. Automated remediation may be possible using AWS Config remediation actions or AWS Lambda, depending on the control.
Identity Integration
Control Tower integrates with AWS IAM Identity Center to support centralized and federated access. Identity sources can include:
- The IAM Identity Center directory.
- A SAML 2.0 identity provider.
- Microsoft Active Directory.
This supports single sign-on across accounts while centralizing workforce access management.
Exam-Relevant Takeaways
- Organizations manages accounts, OUs, consolidated billing, and organization policies.
- Control Tower uses Organizations to deploy and govern a multi-account landing zone.
- A landing zone provides a standardized baseline, not necessarily the final account structure.
- Preventive guardrails use SCP-style restrictions to stop disallowed actions.
- Detective guardrails use AWS Config-based checks to identify noncompliant resources.
- SCPs restrict permissions but do not grant permissions.
- The management account is not restricted by SCPs in the same way member accounts are.
- The log archive account is intended for centralized, protected storage of CloudTrail and AWS Config logs.
- The audit account provides a centralized location for audit and compliance information.
- Account Factory automates the creation of governed AWS accounts.
- IAM Identity Center provides centralized workforce access and supports external identity providers.
Architecture Decision Guide
| Requirement | Relevant capability | Why it matters |
|---|---|---|
| Manage many AWS accounts | AWS Organizations | Provides account grouping, OUs, consolidated billing, and organization policies. |
| Establish a governed multi-account baseline | AWS Control Tower landing zone | Automates a recommended initial topology and governance configuration. |
| Prevent an API action across member accounts | SCP or preventive guardrail | Limits the maximum permissions available to accounts or OUs. |
| Find resources that violate configuration standards | AWS Config or detective guardrail | Detects noncompliant resource configurations. |
| Preserve centralized audit logs | Log archive account | Separates audit data from workload administrators and accounts. |
| Centralize security and compliance review | Audit account | Aggregates governance and audit information. |
| Provision accounts consistently | Control Tower Account Factory | Automates account creation using approved baseline settings. |
| Provide centralized workforce sign-in | IAM Identity Center | Supports federated single sign-on across AWS accounts. |
Common Exam Traps
- Confusing SCPs with IAM permissions: An SCP never grants access. An IAM identity or resource policy must still allow the operation.
- Assuming Control Tower replaces Organizations: Control Tower is built on and extends Organizations.
- Using detective controls when prevention is required: AWS Config can identify a public S3 bucket, but an SCP-based control is more appropriate when the action must be blocked before it happens.
- Assuming all accounts are equally restricted: SCP restrictions do not apply to the management account in the same manner as member accounts.
- Treating the landing zone as immutable: The initial Control Tower topology is a baseline that can be expanded with additional OUs and accounts.
- Confusing the audit and log archive accounts: The log archive account is focused on centralized log storage, while the audit account is used for centralized audit and compliance access.
- Assuming a detective guardrail automatically fixes every violation: Detection and remediation are separate concerns; remediation must be configured and supported for the relevant control.
- Allowing broad administrative access to shared accounts: Centralized governance accounts contain sensitive logs and controls and should have tightly restricted access.
Real-World Engineer Notes
- Protect the management account as a high-value control plane. Use strong authentication, minimal human access, and carefully managed break-glass procedures.
- Treat the log archive account as a security boundary. Restrict deletion and modification of log data and separate log administration from workload administration.
- Use OUs to reflect governance boundaries, such as production, nonproduction, security, and sandbox environments.
- Combine preventive and detective controls. Prevention reduces the probability of a violation, while detection provides visibility when configuration drift or an unaddressed gap occurs.
- Evaluate guardrails against application requirements before broad deployment. A restrictive SCP can affect services or automation if applied at an inappropriate OU level.
- Standardized account provisioning reduces configuration drift and makes security controls repeatable.
- Centralized identity through IAM Identity Center is generally easier to govern than maintaining separate IAM users in every account.
Quick Reference Summary
- Organizations: Multi-account management foundation.
- Control Tower: Governance and automation layer over Organizations.
- Landing zone: Preconfigured, multi-account AWS baseline.
- Management account: Organization root and Control Tower administration account.
- Log archive account: Centralized CloudTrail and AWS Config log storage.
- Audit account: Centralized audit and compliance information.
- Preventive guardrails: Usually SCP-based; block prohibited actions.
- Detective guardrails: Usually AWS Config-based; identify violations.
- Account Factory: Standardized account provisioning.
- IAM Identity Center: Federated single sign-on across accounts.
Flashcards
- Q: What is the relationship between AWS Organizations and Control Tower?
A: Control Tower uses and extends Organizations with landing zones, guardrails, account provisioning, centralized logging, and governance automation.
- Q: What is a Control Tower landing zone?
A: A governed, multi-account AWS baseline containing recommended accounts, OUs, logging, identity integration, and controls.
- Q: What is the purpose of the management account?
A: It is the root of the Organization and is used to launch and administer Control Tower.
- Q: What is stored in the log archive account?
A: Centralized copies of logs such as AWS CloudTrail and AWS Config logs.
- Q: What is the primary purpose of the audit account?
A: To provide a centralized location for audit and compliance information collected from organization accounts.
- Q: What AWS feature commonly implements preventive guardrails?
A: Service control policies, or SCPs.
- Q: Do SCPs grant permissions?
A: No. They set the maximum permissions that IAM policies can grant.
- Q: What service commonly supports detective guardrails?
A: AWS Config, often with rules and optional remediation.
- Q: What is an example of a preventive guardrail?
A: Blocking deletion of CloudTrail logs or preventing unrestricted SSH access from 0.0.0.0/0.
- Q: What is an example of a detective guardrail?
A: Detecting an S3 bucket that is publicly accessible or an unencrypted RDS instance.
- Q: What is Account Factory used for?
A: Automating the creation of standardized, governed AWS accounts.
- Q: Which service provides Control Tower’s centralized workforce sign-in integration?
A: AWS IAM Identity Center, with support for sources such as SAML 2.0 identity providers and Microsoft Active Directory.
Practice Questions
Question 1
A company wants to prevent administrators in member accounts from deleting AWS CloudTrail logs. Which Control Tower capability best addresses this requirement?
A. A detective guardrail using AWS Config
B. A preventive guardrail implemented with an SCP
C. An IAM identity policy allowing CloudTrail access
D. An S3 lifecycle rule in each workload account
Correct answer: B
Explanation: A preventive guardrail can use an SCP to deny the relevant deletion actions before they occur. AWS Config would detect the issue after a violation, while an allow policy does not prevent deletion.
Question 2
A security team wants to identify S3 buckets that are publicly accessible without necessarily blocking all bucket policy changes. Which capability should it use?
A. Detective guardrail backed by AWS Config
B. Preventive guardrail backed by an SCP
C. Consolidated billing
D. Account Factory
Correct answer: A
Explanation: Detective guardrails use AWS Config-style compliance checks to identify resources that violate security requirements, such as public S3 access.
Question 3
An organization wants a standardized multi-account foundation with centralized logging, an audit account, federated access, and governance controls. Which AWS service is most appropriate?
A. AWS Organizations alone, with no additional automation
B. AWS Control Tower
C. AWS CloudTrail
D. AWS IAM Identity Center alone
Correct answer: B
Explanation: Control Tower builds on Organizations and provides a landing zone, shared governance accounts, guardrails, account provisioning, centralized logging, and IAM Identity Center integration.
Question 4
An IAM policy in a member account allows a user to perform an API action. However, the action fails because an SCP attached to the account’s OU denies it. Why?
A. SCPs override all IAM policies and grant an alternative permission
B. SCPs define the maximum permissions available to accounts
C. AWS Config automatically removed the IAM policy
D. The account must use the management account to perform all API actions
Correct answer: B
Explanation: An SCP does not grant permissions. It establishes a permissions boundary for the account or OU. The action requires both an IAM allow and an applicable SCP that does not deny it.
Question 5
A company wants to automate the creation of new development and production accounts while applying an approved Control Tower baseline. Which feature should it use?
A. Account Factory
B. AWS Config remediation only
C. CloudTrail event history
D. Consolidated billing
Correct answer: A
Explanation: Control Tower Account Factory automates standardized account provisioning within the governed landing zone.