Security Foundations and Governance · Topic 2 of 6
Control Tower and Landing Zones
Set up a governed multi account environment with AWS Control Tower landing zones, controls, Account Factory, customization options and drift detection.
- 5 min
- Control Tower creates a landing zone with a management account, a log archive account and an audit account.
- The home Region is chosen at setup and cannot be changed without decommissioning the landing zone.
- Preventive controls use SCPs, detective controls use Config rules, and proactive controls use CloudFormation Hooks.
What it is
AWS Control Tower builds and governs a multi account environment based on AWS best practice. It sets up a landing zone, which is a baseline set of accounts, OUs, identity, logging and guardrails, and it gives you an automated way to create new accounts that follow the baseline.
Control Tower sits on top of AWS Organizations and other services. It is the quickest route to a secure starting point, and the exam asks when to choose it over assembling the pieces by hand.
How it works
What the landing zone contains
- A management account where you run Control Tower.
- A log archive account that holds the central S3 buckets for CloudTrail and Config logs.
- An audit account (security) with read and audit access across accounts, used by security and compliance teams.
- Organizational units, starting with a Security OU and a Sandbox OU, plus ones you add.
- Organization wide CloudTrail and AWS Config recording in governed Regions.
- IAM Identity Center for workforce access, with default groups and permission sets.
- Preventive and detective controls applied to the OUs.
You choose a home Region at setup, which cannot be changed later without decommissioning, and a set of governed Regions where controls apply.
Controls
Controls (previously called guardrails) are governance rules. They have a behaviour and a guidance level.
| Behaviour | Implemented with | What it does |
|---|---|---|
| Preventive | Service control policies | Blocks an action from happening |
| Detective | AWS Config rules | Detects and reports non compliance |
| Proactive | CloudFormation Hooks | Checks resources before CloudFormation creates them |
Guidance describes how strongly AWS recommends the control: mandatory (always on and cannot be disabled), strongly recommended, or elective. Examples include disallowing public S3 buckets, requiring encryption on volumes and denying changes to the logging configuration.
Enable controls on an OU, and they apply to accounts in it, including those added later. A Region deny control stops use of non governed Regions.
Account Factory
Account Factory provisions new accounts that include the baseline. You can request an account through the console or through AWS Service Catalog, set its OU, name and email, and it receives the guardrails and Identity Center access automatically.
Customisation has several options.
| Option | Use it for |
|---|---|
| Account Factory Customization | Attach blueprints, such as CloudFormation templates, that run on new accounts |
| Customizations for AWS Control Tower (CfCT) | Deploy CloudFormation templates and SCPs from a pipeline to accounts and OUs |
| Account Factory for Terraform (AFT) | Provision and customise accounts with a Terraform pipeline |
Use the customisation path that fits your tooling. AFT suits teams working in Terraform, and CfCT suits teams in CloudFormation.
Enrolling existing accounts and drift
You can bring an existing Organization and accounts under Control Tower by enrolling OUs and accounts, as long as prerequisites are met, such as a Config recorder not already conflicting. Enrolment applies the baseline and controls.
Drift occurs when someone changes a governed resource outside Control Tower, for example by moving an account between OUs or modifying the controls' SCPs. Control Tower detects drift and reports it, and you repair it by re-registering the OU or updating the landing zone. Do not edit the SCPs and stacks that Control Tower creates.
Control Tower or Organizations alone
| Situation | Choose |
|---|---|
| New environment that needs a secure baseline quickly | Control Tower |
| Established custom landing zone with its own tooling | Organizations with your own automation |
| Need curated, AWS managed controls and a dashboard | Control Tower |
| Highly unusual structure, or a Region setup Control Tower does not support | Organizations with custom automation |
Control Tower does not replace the need to understand Organizations. It automates it, and the underlying SCPs, Config rules and accounts remain there.
Operating the landing zone
- Keep the audit and log archive accounts tightly controlled.
- Update the landing zone when new versions are available, since updates add controls and fixes.
- Add governed Regions deliberately, because controls and logging expand to them.
- Use delegated administrators for GuardDuty, Security Hub and others, in a dedicated security tooling account, with the audit account serving the audit role.
- Retain logs according to policy by configuring bucket lifecycle on the log archive.
Common failure points
Enrolment fails when AWS Config is already set up in an account in a way that conflicts, or when a required role is missing. Account creation can fail on service limits. A change to the Region setup requires a landing zone update, which can take time and should happen in a quiet period.
What to remember for the exam
- Control Tower creates a landing zone with a management account, a log archive account and an audit account.
- The home Region is chosen at setup and cannot be changed without decommissioning the landing zone.
- Preventive controls use SCPs, detective controls use Config rules, and proactive controls use CloudFormation Hooks.
- Mandatory controls cannot be disabled.
- Account Factory creates accounts with the baseline, and AFT and CfCT add customisation.
- Drift is detected when governed resources are changed outside Control Tower, and fixed by re-registering the OU or updating.
- Existing accounts can be enrolled into Control Tower.
- Control Tower is built on Organizations, so SCP rules still apply.
When a question asks for "the fastest way to set up a multi account environment with security guardrails and a repeatable account vending process", choose Control Tower with Account Factory.
Common mistakes
Editing Control Tower managed resources by hand. This causes drift, so use the supported customisation path.
Choosing the wrong home Region. It cannot be changed, so pick one that matches residency and service availability.
Confusing the two shared accounts. The log archive account stores logs, and the audit account provides access for security review.
Expecting every control to be on. Only mandatory controls are on by default, so enable strongly recommended and elective controls deliberately.
Disabling Control Tower's AWS Config or CloudTrail setup outside its own workflow breaks governance and creates drift that can be hard to repair.
Check yourself
Which controls cannot be turned off in Control Tower?
Mandatory controls.
What implements a preventive control, and what implements a detective one?
A preventive control uses an SCP, and a detective control uses an AWS Config rule.
What are the two shared accounts a landing zone creates?
The log archive account and the audit account.
Topic 2 of 6 in Security Foundations and Governance
Test yourself on Security Foundations and Governance
The full AWS SCS-C03 question bank has 858 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.