{"id":261,"date":"2026-04-13T09:53:30","date_gmt":"2026-04-13T09:53:30","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/aws-control-tower-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-management-and-governance\/"},"modified":"2026-04-13T09:53:30","modified_gmt":"2026-04-13T09:53:30","slug":"aws-control-tower-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-management-and-governance","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/aws-control-tower-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-management-and-governance\/","title":{"rendered":"AWS Control Tower Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Management and governance"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Management and governance<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<p>AWS Control Tower is an AWS service for setting up and governing a secure, multi-account AWS environment using AWS best practices. It helps you build a standardized \u201clanding zone\u201d and continuously enforce governance across accounts, organizational units (OUs), and AWS Regions.<\/p>\n\n\n\n<p>In simple terms: <strong>AWS Control Tower gives you a ready-to-use multi-account structure (security, logging, and workload accounts), plus guardrails (controls) that help keep accounts compliant<\/strong>\u2014without you having to stitch everything together manually.<\/p>\n\n\n\n<p>Technically, AWS Control Tower orchestrates and configures several foundational AWS services\u2014especially <strong>AWS Organizations<\/strong>, <strong>AWS IAM Identity Center<\/strong> (formerly AWS Single Sign-On), <strong>AWS Config<\/strong>, and <strong>AWS CloudTrail<\/strong>\u2014to create a governed environment. It provides a Control Tower dashboard, account provisioning (Account Factory), controls (preventive\/detective\/proactive), and workflows to enroll existing accounts and manage governance at scale.<\/p>\n\n\n\n<p>The problem it solves: as AWS usage grows, teams often end up with inconsistent account setups, ad-hoc logging, uneven security baselines, and fragmented access control. AWS Control Tower addresses this by providing <strong>standardized multi-account governance<\/strong>\u2014a core need in <strong>Management and governance<\/strong> for AWS.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is AWS Control Tower?<\/h2>\n\n\n\n<p><strong>Official purpose:<\/strong> AWS Control Tower helps organizations set up and govern a secure, compliant, multi-account AWS environment. It\u2019s designed to accelerate multi-account adoption using prescriptive best practices and built-in governance.<\/p>\n\n\n\n<p><strong>Core capabilities<\/strong>\n&#8211; <strong>Landing zone setup<\/strong>: Create a baseline multi-account environment (core accounts, OUs, centralized logging).\n&#8211; <strong>Account provisioning<\/strong>: Create new accounts with a standardized baseline via <strong>Account Factory<\/strong>.\n&#8211; <strong>Account enrollment<\/strong>: Bring existing AWS accounts into the governed environment.\n&#8211; <strong>Controls (guardrails)<\/strong>: Apply governance policies across OUs\/accounts:\n  &#8211; <strong>Preventive controls<\/strong> (typically enforced using Service Control Policies in AWS Organizations)\n  &#8211; <strong>Detective controls<\/strong> (typically monitored using AWS Config rules and surfaced as compliance)\n  &#8211; <strong>Proactive controls<\/strong> (implemented via CloudFormation-based validation mechanisms; availability varies\u2014verify in official docs)\n&#8211; <strong>Governed Regions<\/strong>: Extend governance beyond the home region into additional regions (feature details vary by region and time\u2014verify in official docs).\n&#8211; <strong>Visibility<\/strong>: A dashboard to track compliance status and governance posture.<\/p>\n\n\n\n<p><strong>Major components<\/strong>\n&#8211; <strong>AWS Organizations<\/strong>: The multi-account backbone (management account, member accounts, OUs, SCPs).\n&#8211; <strong>AWS IAM Identity Center<\/strong>: Central workforce identity and permission sets for accessing accounts.\n&#8211; <strong>Controls library<\/strong>: The set of governance controls you can enable on OUs\/accounts.\n&#8211; <strong>Account Factory<\/strong>: A standardized workflow (backed by AWS Service Catalog) for provisioning accounts.\n&#8211; <strong>Landing zone resources<\/strong>: Shared logging, security accounts, roles, trails, config recorders, aggregators, and supporting infrastructure.<\/p>\n\n\n\n<p><strong>Service type<\/strong>\n&#8211; A <strong>management and governance<\/strong> orchestration service that configures and coordinates other AWS services.\n&#8211; Not a compute, storage, or networking service by itself\u2014its \u201coutputs\u201d are configuration, governance, and accounts.<\/p>\n\n\n\n<p><strong>Scope (regional\/global\/account)<\/strong>\n&#8211; AWS Control Tower is managed through a <strong>selected home AWS Region<\/strong> and can govern accounts in the organization. It works at the <strong>AWS Organization<\/strong> level and applies governance to <strong>OUs and accounts<\/strong>. It is not tied to a single VPC or project; it governs at the <strong>organization\/account boundary<\/strong>.<\/p>\n\n\n\n<p><strong>How it fits into the AWS ecosystem<\/strong>\nAWS Control Tower is often the starting point for:\n&#8211; Enterprise AWS adoption (multi-account foundations)\n&#8211; Platform engineering \u201cgolden paths\u201d\n&#8211; Centralized security operations and audit readiness\n&#8211; Scalable account vending and governance automation<\/p>\n\n\n\n<p>If you are building an AWS platform, AWS Control Tower is commonly the <strong>first governance layer<\/strong>\u2014with additional services layered on top (AWS Security Hub, AWS GuardDuty, AWS Firewall Manager, AWS IAM Access Analyzer, AWS Organizations SCP strategy, and CI\/CD-based infrastructure).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use AWS Control Tower?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Faster cloud adoption<\/strong>: Sets up a multi-account environment quickly without bespoke scripts.<\/li>\n<li><strong>Standardization<\/strong>: Reduces variance across teams, improving predictability and audit outcomes.<\/li>\n<li><strong>Reduced risk<\/strong>: Centralized guardrails lower the chance of misconfigurations and policy drift.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Opinionated landing zone<\/strong>: Implements AWS-recommended baseline patterns (central logging, dedicated security\/audit account).<\/li>\n<li><strong>Account lifecycle automation<\/strong>: Provision accounts with consistent baseline settings.<\/li>\n<li><strong>Controls at scale<\/strong>: Apply governance at the OU level, inheriting to many accounts.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Central visibility<\/strong>: A single dashboard for governance and compliance reporting.<\/li>\n<li><strong>Easier onboarding<\/strong>: \u201cVending\u201d accounts to teams is repeatable and controlled.<\/li>\n<li><strong>Reduced toil<\/strong>: Less custom glue for AWS Config, CloudTrail, Organizations, IAM federation setup.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Centralized logs<\/strong>: CloudTrail and configuration history centrally archived for investigations and audits.<\/li>\n<li><strong>SCP-based prevention<\/strong>: Enforce organization-wide restrictions (where applicable).<\/li>\n<li><strong>Continuous compliance monitoring<\/strong>: Detective controls flag drift and misconfigurations.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Scales governance across many accounts<\/strong>: Instead of per-account manual setup.<\/li>\n<li><strong>OU-based policy inheritance<\/strong>: Minimizes per-account changes and supports large org structures.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose AWS Control Tower<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You plan to use <strong>multiple AWS accounts<\/strong> (almost always true beyond small teams).<\/li>\n<li>You need a <strong>repeatable account factory<\/strong> and a baseline governance posture.<\/li>\n<li>You want AWS-native, supported landing zone patterns rather than building everything yourself.<\/li>\n<li>You need to onboard many teams\/workloads while maintaining consistent guardrails.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should not choose AWS Control Tower<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You are committed to <strong>a single-account strategy<\/strong> and do not expect to scale.<\/li>\n<li>You require <strong>highly customized<\/strong> landing zone behavior that conflicts with Control Tower\u2019s opinionated setup (for example, heavily bespoke IAM federation and logging patterns), and you are prepared to operate your own solution.<\/li>\n<li>You already have a mature landing zone and governance system, and migrating would introduce unacceptable risk or downtime (Control Tower can enroll existing accounts, but alignment work can still be significant).<\/li>\n<li>You are constrained by Regions where AWS Control Tower is not available or where specific capabilities you need are not supported (verify Region availability in official docs).<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is AWS Control Tower used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Financial services and fintech (auditability, separation of duties, strong governance)<\/li>\n<li>Healthcare and life sciences (compliance and traceability)<\/li>\n<li>Retail and e-commerce (many teams and environments)<\/li>\n<li>SaaS and technology companies (platform-driven multi-account growth)<\/li>\n<li>Government and regulated industries (policy enforcement, centralized logging)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Center of Excellence (CCoE)<\/li>\n<li>Platform engineering teams<\/li>\n<li>Security engineering and GRC teams<\/li>\n<li>DevOps\/SRE teams supporting multiple product teams<\/li>\n<li>Enterprise architecture teams defining guardrails<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Multi-environment application stacks (dev\/test\/stage\/prod)<\/li>\n<li>Data platforms (data lake, analytics accounts, ML accounts)<\/li>\n<li>Shared services (networking, identity, security tooling)<\/li>\n<li>Sandbox accounts for experimentation with controlled risk<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Multi-account, multi-VPC environments<\/li>\n<li>Hub-and-spoke networking (often paired with AWS Transit Gateway)<\/li>\n<li>Centralized security logging and monitoring<\/li>\n<li>Federated identity and least privilege at scale<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Real-world deployment contexts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Greenfield<\/strong>: Launch Control Tower early, then create accounts and OUs as the organization grows.<\/li>\n<li><strong>Brownfield<\/strong>: Enroll existing accounts, reconcile baseline logging and configuration, then progressively apply controls.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Production vs dev\/test usage<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>In production, AWS Control Tower is frequently used to govern:<\/li>\n<li>Production accounts (strict OUs, strong controls)<\/li>\n<li>Non-production accounts (different OU, different control set)<\/li>\n<li>Sandbox accounts (restricted permissions, strong cost controls)<\/li>\n<li>For dev\/test, it provides safe boundaries and consistent account setups to reduce operational surprises later.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic scenarios where AWS Control Tower is commonly used.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Enterprise landing zone bootstrap<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> You need a secure multi-account baseline quickly, but building it from scratch is slow and error-prone.<\/li>\n<li><strong>Why this service fits:<\/strong> Control Tower sets up core accounts, centralized logging, and governance controls using AWS best practices.<\/li>\n<li><strong>Example scenario:<\/strong> A global enterprise needs to migrate dozens of apps; Control Tower establishes the organization structure in days, not months.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Account vending for product teams<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Teams request new AWS accounts frequently; manual provisioning causes inconsistency and delays.<\/li>\n<li><strong>Why this service fits:<\/strong> Account Factory standardizes creation and baseline configuration.<\/li>\n<li><strong>Example scenario:<\/strong> A platform team provisions a new \u201cteam-dev\u201d and \u201cteam-prod\u201d account for each new product line.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) OU-based governance by environment (prod vs non-prod)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Production accounts require stricter policies than dev accounts.<\/li>\n<li><strong>Why this service fits:<\/strong> Controls can be applied to OUs and inherited by all accounts in that OU.<\/li>\n<li><strong>Example scenario:<\/strong> A \u201cProduction\u201d OU enforces stricter detective\/preventive controls than the \u201cDevelopment\u201d OU.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Centralized audit and forensics logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Logs are scattered across accounts and can be deleted by compromised admins.<\/li>\n<li><strong>Why this service fits:<\/strong> Control Tower centralizes CloudTrail and related logs into dedicated accounts (for example, Log Archive).<\/li>\n<li><strong>Example scenario:<\/strong> After a security incident, investigators pull immutable audit data from centralized S3 buckets in the log archive account.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Enrolling acquired company accounts (M&amp;A)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Newly acquired AWS accounts have unknown posture and inconsistent baseline.<\/li>\n<li><strong>Why this service fits:<\/strong> Enroll accounts and apply a governance baseline and controls progressively.<\/li>\n<li><strong>Example scenario:<\/strong> A parent company enrolls a subsidiary\u2019s accounts under a \u201cSubsidiary\u201d OU, then tightens controls over time.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Rapidly scaling startup moving from single to multi-account<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> One account becomes chaotic: IAM sprawl, shared blast radius, billing confusion.<\/li>\n<li><strong>Why this service fits:<\/strong> Control Tower creates clear account boundaries and governance with minimal operational overhead.<\/li>\n<li><strong>Example scenario:<\/strong> A startup splits into \u201cshared-services\u201d, \u201csecurity\u201d, and \u201cprod\u201d accounts and starts using OU-based controls.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Regulatory compliance baseline (e.g., SOC 2, ISO 27001)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Auditors want consistent logging, change tracking, and preventative policies.<\/li>\n<li><strong>Why this service fits:<\/strong> Control Tower provides built-in governance patterns and continuous compliance signals via detective controls.<\/li>\n<li><strong>Example scenario:<\/strong> A SaaS company uses Control Tower to show centralized logging and configuration monitoring across all accounts.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Standardized sandbox accounts with cost containment<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Engineers need freedom to experiment, but uncontrolled sandbox spending becomes expensive.<\/li>\n<li><strong>Why this service fits:<\/strong> Provision sandbox accounts with restricted policies, budget alerts (via additional tooling), and logging.<\/li>\n<li><strong>Example scenario:<\/strong> Each engineer gets a sandbox account in a \u201cSandbox\u201d OU with strong preventive controls and billing alerts (configured separately).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Multi-region governance expansion<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Teams start deploying to multiple regions, but governance is inconsistent.<\/li>\n<li><strong>Why this service fits:<\/strong> Control Tower can govern multiple regions (governed regions concept).<\/li>\n<li><strong>Example scenario:<\/strong> A company expands from us-east-1 to eu-west-1 and extends governance so detective controls and logging expectations remain consistent.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Delegated administration model for large organizations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A central team cannot manage everything; you need delegation without losing control.<\/li>\n<li><strong>Why this service fits:<\/strong> Control Tower and related AWS services support delegated administration patterns (capabilities vary\u2014verify in official docs for your use case).<\/li>\n<li><strong>Example scenario:<\/strong> A security team manages security services in the audit\/security account while platform teams manage workload OUs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">11) Standardizing identity access across accounts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Users need consistent access patterns; per-account IAM users and roles don\u2019t scale.<\/li>\n<li><strong>Why this service fits:<\/strong> Control Tower integrates with IAM Identity Center for centralized access and permission sets.<\/li>\n<li><strong>Example scenario:<\/strong> Developers use IAM Identity Center permission sets to access dev accounts, while production access is limited and time-bound.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">12) Reducing \u201cshadow IT\u201d AWS accounts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Teams create accounts outside governance, leading to untracked spend and risk.<\/li>\n<li><strong>Why this service fits:<\/strong> A formal account vending and governance model makes it easier to do the right thing than to bypass the platform.<\/li>\n<li><strong>Example scenario:<\/strong> The platform team requires all accounts to be provisioned via Account Factory and moved into governed OUs.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Landing zone setup<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Establishes a multi-account baseline with core accounts, OUs, logging, and governance configuration.<\/li>\n<li><strong>Why it matters:<\/strong> A consistent foundation prevents fragmented security and operations.<\/li>\n<li><strong>Practical benefit:<\/strong> Faster, repeatable setup without writing custom provisioning scripts.<\/li>\n<li><strong>Caveats:<\/strong> Control Tower is opinionated. Retrofitting into a heavily customized environment may require careful planning.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Controls (guardrails): preventive, detective, and proactive<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Applies governance policies at OU\/account scope.<\/li>\n<li><strong>Preventive controls<\/strong> typically use <strong>SCPs<\/strong> to deny noncompliant API actions.<\/li>\n<li><strong>Detective controls<\/strong> typically use <strong>AWS Config<\/strong> to detect noncompliance.<\/li>\n<li><strong>Proactive controls<\/strong> provide pre-deployment validation for certain resource types (availability and implementation details can evolve\u2014verify in official docs).<\/li>\n<li><strong>Why it matters:<\/strong> Governance becomes scalable and consistent.<\/li>\n<li><strong>Practical benefit:<\/strong> Enforce rules once at the OU level instead of per account.<\/li>\n<li><strong>Caveats:<\/strong> Not every desired policy exists as a built-in control; custom governance may still be needed (for example, custom SCPs, Config rules, or CI\/CD policy-as-code).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Account Factory (account provisioning)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Provisions new AWS accounts with standard settings and places them into selected OUs.<\/li>\n<li><strong>Why it matters:<\/strong> Account creation becomes repeatable and auditable.<\/li>\n<li><strong>Practical benefit:<\/strong> Developers get new accounts quickly; platform teams maintain baseline consistency.<\/li>\n<li><strong>Caveats:<\/strong> Account provisioning requires unique email addresses per account and is subject to AWS Organizations account limits\/quotas.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Enroll existing accounts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Brings existing AWS accounts under Control Tower governance and baseline.<\/li>\n<li><strong>Why it matters:<\/strong> Real organizations often already have accounts.<\/li>\n<li><strong>Practical benefit:<\/strong> Gradual migration to a standardized governance model.<\/li>\n<li><strong>Caveats:<\/strong> Existing accounts may already have CloudTrail\/AWS Config\/IAM setups that conflict with Control Tower expectations. Enrollment can require remediation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governed Regions<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Extends governance expectations (for example, logging and detective controls) into additional AWS Regions.<\/li>\n<li><strong>Why it matters:<\/strong> Prevents \u201cregion sprawl\u201d from bypassing governance.<\/li>\n<li><strong>Practical benefit:<\/strong> Consistent compliance posture even as teams expand regions.<\/li>\n<li><strong>Caveats:<\/strong> Region support and feature parity can vary; always confirm in official docs for your chosen regions.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Centralized logging and auditability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Establishes centralized logging patterns (notably CloudTrail and related logs) in dedicated accounts (commonly Log Archive and Audit).<\/li>\n<li><strong>Why it matters:<\/strong> Supports security investigations and compliance reporting.<\/li>\n<li><strong>Practical benefit:<\/strong> Logs are harder to tamper with and easier to query centrally.<\/li>\n<li><strong>Caveats:<\/strong> Central logs incur ongoing storage and potentially data event costs; ensure lifecycle policies and log retention align to compliance needs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Dashboard and compliance reporting<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Provides a governance view across accounts\/OUs and control compliance.<\/li>\n<li><strong>Why it matters:<\/strong> Operations and security teams need visibility.<\/li>\n<li><strong>Practical benefit:<\/strong> Faster detection of drift and failed control deployments.<\/li>\n<li><strong>Caveats:<\/strong> Compliance signal quality depends on underlying AWS Config rule evaluations and correct region\/account coverage.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Integration with AWS Organizations and SCP strategy<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Uses Organizations to structure accounts and apply preventive controls through SCPs.<\/li>\n<li><strong>Why it matters:<\/strong> Organizations is the enforcement boundary for many governance patterns.<\/li>\n<li><strong>Practical benefit:<\/strong> Central policy controls with OU inheritance.<\/li>\n<li><strong>Caveats:<\/strong> SCPs do not grant permissions; they only limit. You still need well-designed IAM roles and permission sets.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM Identity Center integration (workforce access)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Centralizes user access to accounts and permission sets.<\/li>\n<li><strong>Why it matters:<\/strong> Reduces per-account IAM user sprawl and improves auditability of access.<\/li>\n<li><strong>Practical benefit:<\/strong> Standard login and access assignment patterns across all accounts.<\/li>\n<li><strong>Caveats:<\/strong> Identity source integration (for example, external IdP) must be designed carefully; permission set sprawl is also a risk.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level architecture<\/h3>\n\n\n\n<p>At a high level, AWS Control Tower:\n1. Uses <strong>AWS Organizations<\/strong> to manage accounts and OUs.\n2. Sets up a <strong>landing zone<\/strong> with core accounts (commonly:\n   &#8211; <strong>Management account<\/strong> (where Organizations is managed)\n   &#8211; <strong>Log archive account<\/strong> (centralized logging)\n   &#8211; <strong>Audit account<\/strong> (security\/audit read access and investigations))\n3. Configures <strong>IAM Identity Center<\/strong> for workforce access.\n4. Implements governance via <strong>controls<\/strong>:\n   &#8211; Preventive controls enforced via SCPs at OU\/account scope.\n   &#8211; Detective controls evaluated by AWS Config and surfaced as compliance.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Request\/data\/control flow (typical)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>User access:<\/strong> Users authenticate via IAM Identity Center and assume roles into member accounts using permission sets.<\/li>\n<li><strong>Provisioning:<\/strong> Account Factory provisions accounts into OUs and applies baseline configuration.<\/li>\n<li><strong>Governance enforcement:<\/strong><\/li>\n<li>SCPs deny prohibited API actions (preventive).<\/li>\n<li>AWS Config continuously evaluates resource configuration (detective).<\/li>\n<li><strong>Logging and audit:<\/strong><\/li>\n<li>CloudTrail delivers events (management events by default; data events if enabled) to central S3 buckets in the log archive account.<\/li>\n<li>Security teams use audit account access and tooling (often Security Hub\/GuardDuty\u2014optional) to investigate.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Integrations with related services<\/h3>\n\n\n\n<p>Common direct and indirect integrations include:\n&#8211; <strong>AWS Organizations<\/strong> (required)\n&#8211; <strong>AWS IAM Identity Center<\/strong> (required for Control Tower user access patterns)\n&#8211; <strong>AWS Service Catalog<\/strong> (used by Account Factory)\n&#8211; <strong>AWS Config<\/strong> (detective controls and compliance)\n&#8211; <strong>AWS CloudTrail<\/strong> (central audit logging)\n&#8211; <strong>Amazon S3<\/strong> (log archive storage)\n&#8211; <strong>Amazon CloudWatch \/ CloudWatch Logs<\/strong> (operational logs and metrics; exact usage depends on configuration)\n&#8211; <strong>AWS CloudFormation<\/strong> (used behind the scenes for some control deployments; also relevant for proactive controls\u2014verify per control)\n&#8211; Optional but common in production:\n  &#8211; <strong>AWS Security Hub<\/strong>, <strong>Amazon GuardDuty<\/strong>, <strong>AWS IAM Access Analyzer<\/strong>\n  &#8211; <strong>AWS Firewall Manager<\/strong> (for centralized network security policies)\n  &#8211; <strong>AWS Transit Gateway<\/strong> and centralized networking accounts<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services<\/h3>\n\n\n\n<p>AWS Control Tower depends on:\n&#8211; AWS Organizations\n&#8211; IAM Identity Center\n&#8211; Config and CloudTrail for many governance features\n&#8211; Supporting IAM roles and service-linked roles<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Organizational administration is performed in the <strong>management account<\/strong>.<\/li>\n<li>Workforce access is typically via <strong>IAM Identity Center<\/strong> permission sets, which create roles in target accounts.<\/li>\n<li>Control Tower also creates and relies on various IAM roles for automation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS Control Tower governance is primarily <strong>control-plane oriented<\/strong>. It doesn\u2019t require a shared VPC.<\/li>\n<li>It can be paired with separate network architectures (hub-and-spoke, shared VPCs, transit gateway, etc.).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ensure CloudTrail and Config coverage aligns with your governed regions and compliance needs.<\/li>\n<li>Use the Control Tower dashboard plus account-level monitoring.<\/li>\n<li>Consider additional detective tooling (Security Hub, GuardDuty) and centralized SIEM ingestion.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Simple architecture diagram (conceptual)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  U[Users \/ Admins] --&gt; IC[IAM Identity Center]\n  IC --&gt; A1[Workload Account A]\n  IC --&gt; A2[Workload Account B]\n\n  CT[AWS Control Tower] --&gt; ORG[AWS Organizations]\n  ORG --&gt; OU1[OUs]\n  OU1 --&gt; A1\n  OU1 --&gt; A2\n\n  CT --&gt; CFG[AWS Config Rules]\n  CT --&gt; SCP[Service Control Policies]\n\n  CT --&gt; CTL[Controls Library]\n  CT --&gt; TRAIL[AWS CloudTrail]\n  TRAIL --&gt; S3[Central S3 Log Archive]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Production-style architecture diagram (more realistic)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph Org[AWS Organization]\n    MA[Management Account\\n(Control Tower + Organizations)]\n    subgraph SecurityOU[Security OU]\n      LA[Log Archive Account\\n(S3 log buckets, retention)]\n      AU[Audit Account\\n(Security read\/investigation)]\n    end\n\n    subgraph Workloads[Workload OUs]\n      ProdOU[Production OU]\n      DevOU[Development OU]\n      SandboxOU[Sandbox OU]\n      P1[Prod Account 1]\n      D1[Dev Account 1]\n      S1[Sandbox Account 1]\n    end\n  end\n\n  Users[Workforce Users] --&gt; IC[IAM Identity Center\\n(SSO, Permission Sets)]\n  IC --&gt; P1\n  IC --&gt; D1\n  IC --&gt; S1\n\n  MA --&gt; CT[AWS Control Tower\\nLanding Zone + Controls]\n  CT --&gt; ORG[AWS Organizations]\n  ORG --&gt; ProdOU\n  ORG --&gt; DevOU\n  ORG --&gt; SandboxOU\n\n  CT --&gt; SCPs[SCPs\\n(Preventive Controls)]\n  SCPs --&gt; ProdOU\n  SCPs --&gt; DevOU\n  SCPs --&gt; SandboxOU\n\n  CT --&gt; Config[AWS Config\\n(Detective Controls)]\n  Config --&gt; P1\n  Config --&gt; D1\n  Config --&gt; S1\n\n  subgraph Logging[Central Logging]\n    Trail[CloudTrail]\n    S3LA[S3 Buckets in Log Archive]\n  end\n\n  Trail --&gt; S3LA\n  P1 --&gt; Trail\n  D1 --&gt; Trail\n  S1 --&gt; Trail\n\n  AU --&gt; Investigations[Audit &amp; Security Tooling\\n(Security Hub\/GuardDuty optional)]\n  S3LA --&gt; AU\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<p>Before you start with AWS Control Tower, confirm the following.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Account\/organization requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An AWS account that will become (or already is) the <strong>AWS Organizations management account<\/strong>.<\/li>\n<li>Ability to create and manage an AWS Organization with <strong>All features<\/strong> enabled.<\/li>\n<li>Ability to create additional AWS accounts (for example, audit and log archive accounts and workload accounts), each requiring:<\/li>\n<li>A unique email address<\/li>\n<li>Compliance with your organization\u2019s account creation policies<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM roles<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You need permissions equivalent to an <strong>administrator<\/strong> in the management account to set up Control Tower and Organizations.<\/li>\n<li>If you use IAM Identity Center, you need permission to configure Identity Center and create permission sets.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Billing requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A valid billing method on the management account.<\/li>\n<li>Awareness that while AWS Control Tower itself may have no additional charge, dependent services can incur costs (see Pricing section).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Tools (optional but recommended)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS Console access (Control Tower setup is commonly performed in the console).<\/li>\n<li>AWS CLI v2 for verification steps:<\/li>\n<li>https:\/\/docs.aws.amazon.com\/cli\/latest\/userguide\/getting-started-install.html<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS Control Tower is not available in every region. Confirm supported regions in the official documentation:<\/li>\n<li>https:\/\/docs.aws.amazon.com\/controltower\/latest\/userguide\/regions.html (verify this URL in case AWS updates doc paths)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS Organizations limits (number of accounts, OUs).<\/li>\n<li>Control Tower limits (controls, enrollments, governed regions). Check <strong>Service Quotas<\/strong> and the Control Tower user guide:<\/li>\n<li>https:\/\/docs.aws.amazon.com\/controltower\/latest\/userguide\/limits.html (verify in official docs)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services<\/h3>\n\n\n\n<p>AWS Control Tower orchestrates multiple services. Expect these to be used:\n&#8211; AWS Organizations\n&#8211; IAM Identity Center\n&#8211; AWS Config\n&#8211; AWS CloudTrail\n&#8211; Amazon S3\n&#8211; AWS Service Catalog (for Account Factory)<\/p>\n\n\n\n<p>If you already have existing organization-wide CloudTrail\/Config setups, plan a reconciliation\u2014enrollment and landing zone setup can fail if configurations conflict.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Current pricing model (accurate, non-fabricated)<\/h3>\n\n\n\n<p>AWS Control Tower is typically described by AWS as having <strong>no additional charge<\/strong> for the service itself, but you pay for <strong>underlying AWS services<\/strong> it uses (for example, AWS Config, CloudTrail, S3, CloudWatch, and others depending on what you enable).<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Official pricing page:<\/li>\n<li>https:\/\/aws.amazon.com\/controltower\/pricing\/<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing dimensions (what you actually pay for)<\/h3>\n\n\n\n<p>You should model costs around these underlying services:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>AWS Config<\/strong>\n   &#8211; Costs depend on configuration items recorded, rule evaluations, conformance packs, aggregators, and the number of regions\/accounts.\n   &#8211; Detective controls often rely on AWS Config evaluations, which can be a major cost driver at scale.<\/p>\n<\/li>\n<li>\n<p><strong>AWS CloudTrail<\/strong>\n   &#8211; Management events: one copy is generally free (confirm current CloudTrail pricing terms).\n   &#8211; Data events (S3 object-level, Lambda invoke, etc.) can be significant if enabled widely.\n   &#8211; CloudTrail Lake (if used) is a separate pricing model.<\/p>\n<\/li>\n<li>\n<p><strong>Amazon S3 (Log Archive)<\/strong>\n   &#8211; Storage for CloudTrail logs and potentially other logs.\n   &#8211; Requests and lifecycle transitions (S3 Standard \u2192 IA\/Glacier) can affect costs.<\/p>\n<\/li>\n<li>\n<p><strong>CloudWatch \/ CloudWatch Logs<\/strong>\n   &#8211; If you stream logs\/metrics to CloudWatch, ingestion and retention add cost.<\/p>\n<\/li>\n<li>\n<p><strong>AWS Service Catalog<\/strong>\n   &#8211; Generally low direct cost, but check if any provisioning actions trigger billable resources.<\/p>\n<\/li>\n<li>\n<p><strong>Data transfer<\/strong>\n   &#8211; Cross-region logging and cross-account access patterns can introduce data transfer charges (especially if you aggregate logs across regions or export to external SIEM).<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Free tier<\/h3>\n\n\n\n<p>There is no special \u201cAWS Control Tower free tier\u201d in the same way as compute services. Instead:\n&#8211; Control Tower may not charge directly\n&#8211; Underlying service usage may or may not fit into AWS Free Tier depending on your account age and usage patterns<\/p>\n\n\n\n<p>Always confirm Free Tier eligibility in your account and region.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Cost drivers (what increases spend)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Number of accounts<\/strong> (each account adds baseline logging\/config footprint)<\/li>\n<li><strong>Number of governed regions<\/strong><\/li>\n<li><strong>Number and type of detective controls<\/strong> (AWS Config evaluations)<\/li>\n<li><strong>CloudTrail data events enabled broadly<\/strong><\/li>\n<li><strong>Log retention period<\/strong> and S3 storage class strategy<\/li>\n<li><strong>High-change environments<\/strong> (frequent resource changes increase Config recording\/evaluations)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Hidden\/indirect costs to watch<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Config explosion<\/strong>: Turning on many detective controls across many accounts\/regions can create a large, recurring AWS Config bill.<\/li>\n<li><strong>S3 log growth<\/strong>: Centralized CloudTrail logs grow steadily; without lifecycle policies, storage costs accumulate.<\/li>\n<li><strong>SIEM exports<\/strong>: Exporting logs to third-party tools can add egress and processing costs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network\/data transfer implications<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Centralizing logs is mostly S3-based and typically cost-efficient, but:<\/li>\n<li>Cross-region replication (if you add it) and cross-region access can add transfer costs.<\/li>\n<li>Exporting logs outside AWS incurs internet egress.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How to optimize cost (without breaking governance)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Start with <strong>mandatory controls<\/strong> and a small set of high-value controls; expand deliberately.<\/li>\n<li>Limit CloudTrail <strong>data events<\/strong> to only critical buckets\/functions (or use targeted selectors).<\/li>\n<li>Apply S3 lifecycle policies for log archive (for example, transition to infrequent access\/archival tiers as compliance allows).<\/li>\n<li>Use governed regions intentionally\u2014avoid enabling extra regions \u201cjust in case.\u201d<\/li>\n<li>Continuously review AWS Config usage; disable unused rules and avoid redundant checks.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate (method, not fabricated numbers)<\/h3>\n\n\n\n<p>A small lab or pilot might include:\n&#8211; 3\u20135 accounts (management, audit, log archive, 1\u20132 workload accounts)\n&#8211; 1 governed region initially\n&#8211; Only baseline controls + a few detective controls<\/p>\n\n\n\n<p>To estimate:\n1. Open <strong>AWS Pricing Calculator<\/strong>: https:\/\/calculator.aws\/\n2. Add line items for:\n   &#8211; AWS Config (per account\/region, expected number of recorded resources and rule evaluations)\n   &#8211; CloudTrail (management events; data events if you plan to enable them)\n   &#8211; S3 storage (estimate log GB\/month and retention)\n   &#8211; CloudWatch Logs (if used)\n3. Compare a \u201cpilot\u201d and \u201cproduction\u201d scenario.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations<\/h3>\n\n\n\n<p>In production, costs can scale with:\n&#8211; Dozens to hundreds of accounts\n&#8211; Multiple governed regions\n&#8211; Broad detective control coverage (Config)\n&#8211; Centralized security tooling (Security Hub, GuardDuty) layered on top<\/p>\n\n\n\n<p>A practical approach:\n&#8211; Build a cost model \u201cper account per region\u201d for baseline (CloudTrail + Config + S3)\n&#8211; Multiply by the number of accounts and governed regions\n&#8211; Add incremental cost per additional detective control category and for data events<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<p>Set up an AWS Control Tower landing zone, provision one new account using Account Factory, enable one control on an OU, and verify compliance signals\u2014using a workflow that is realistic, beginner-friendly, and designed to avoid unnecessary costs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will:\n1. Prepare AWS Organizations and IAM Identity Center prerequisites.\n2. Set up AWS Control Tower (landing zone) in a selected region.\n3. Create a \u201cSandbox\u201d OU (or use an existing workload OU) and provision a new sandbox account via Account Factory.\n4. Enable a detective control for that OU.\n5. Trigger a simple compliance finding and verify it in the Control Tower dashboard (and optionally AWS Config).\n6. Clean up test resources and (optionally) close the provisioned sandbox account to stop future costs.<\/p>\n\n\n\n<blockquote>\n<p>Notes before you begin<br\/>\n&#8211; Control Tower changes your organization and creates resources. Use a dedicated AWS Organization if possible.<br\/>\n&#8211; Account creation and enrollment can take time (often tens of minutes).<br\/>\n&#8211; You will incur some baseline costs for logging and configuration history.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Choose a home region and confirm service availability<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Decide which AWS Region will be your <strong>Control Tower home region<\/strong> (commonly where your platform team operates).<\/li>\n<li>Confirm AWS Control Tower is supported in that region:\n   &#8211; https:\/\/docs.aws.amazon.com\/controltower\/latest\/userguide\/regions.html (verify current list)<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> You have selected a supported home region and will perform the setup there.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; In the AWS Console region selector, switch to your chosen region.\n&#8211; Open the AWS Control Tower console and confirm the \u201cSet up landing zone\u201d workflow is available.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Ensure AWS Organizations is ready (All features)<\/h3>\n\n\n\n<p>AWS Control Tower requires AWS Organizations with <strong>All features<\/strong>.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the AWS Console, go to <strong>AWS Organizations<\/strong>.<\/li>\n<li>If you don\u2019t have an organization:\n   &#8211; Choose <strong>Create organization<\/strong>\n   &#8211; Ensure it is created with <strong>All features<\/strong><\/li>\n<li>If you already have an organization:\n   &#8211; Confirm you are in the <strong>management account<\/strong>\n   &#8211; Confirm the organization is using <strong>All features<\/strong> (not \u201cConsolidated billing\u201d only)<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> AWS Organizations exists and is configured with All features.<\/p>\n\n\n\n<p><strong>Verification (AWS CLI, optional):<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">aws organizations describe-organization\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Enable IAM Identity Center and create an admin user<\/h3>\n\n\n\n<p>AWS Control Tower uses <strong>AWS IAM Identity Center<\/strong> for user access patterns.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open <strong>IAM Identity Center<\/strong> in the AWS Console (in the same region used for Control Tower setup).<\/li>\n<li>Choose <strong>Enable<\/strong> (if not already enabled).<\/li>\n<li>Create at least one administrative user (or integrate with an external identity provider if you already have one).<\/li>\n<li>Ensure you can sign in to the AWS access portal and see the management account when assignments are made.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> IAM Identity Center is enabled and you have an identity to administer Control Tower access.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; IAM Identity Center shows as enabled.\n&#8211; You can access the IAM Identity Center portal URL (from the console).<\/p>\n\n\n\n<blockquote>\n<p>If your enterprise already uses an external IdP (SAML\/OIDC), integrate carefully. For a lab, the default Identity Center directory is simpler.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Set up the AWS Control Tower landing zone<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the <strong>AWS Control Tower<\/strong> console in your selected home region.<\/li>\n<li>Choose <strong>Set up landing zone<\/strong>.<\/li>\n<li>When prompted, configure core settings such as:\n   &#8211; <strong>Core accounts<\/strong>: Audit and Log Archive accounts  <ul>\n<li>You may be able to create them during setup (workflow varies).  <\/li>\n<li><strong>Email addresses<\/strong> for new accounts (must be unique and reachable).<\/li>\n<li><strong>OUs<\/strong> structure (Control Tower sets up a baseline; exact OU names can vary by version).<\/li>\n<\/ul>\n<\/li>\n<li>Review and start the setup.<\/li>\n<\/ol>\n\n\n\n<p>This process creates\/configures:\n&#8211; Organization structure and baseline governance\n&#8211; Centralized logging destinations (S3 buckets in log archive account)\n&#8211; AWS Config recorders and delivery channels (as needed)\n&#8211; Required roles and policies for governance<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong> Landing zone setup completes successfully and the Control Tower dashboard loads without errors.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; In Control Tower console, the landing zone status shows <strong>Active\/Available<\/strong> (wording may vary).\n&#8211; You can see core accounts (management, audit, log archive) in the Control Tower environment view.<\/p>\n\n\n\n<blockquote>\n<p>If setup fails, read the failure reason carefully. The most common causes are pre-existing configurations (CloudTrail\/Config), missing permissions, or unsupported region constraints.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Create (or confirm) a Sandbox OU for the lab<\/h3>\n\n\n\n<p>You want an OU where you can safely test a control.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the Control Tower console, navigate to the organizational structure view.<\/li>\n<li>If you have an OU appropriate for experiments (often \u201cSandbox\u201d or \u201cWorkloads\/NonProd\u201d), use it.<\/li>\n<li>If you need to create one:\n   &#8211; Create an OU in AWS Organizations (or via Control Tower interface if supported in your console experience)\n   &#8211; Name it <code>Sandbox<\/code> (or similar)<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> You have a dedicated OU where you can apply one elective control.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; AWS Organizations shows the OU.\n&#8211; Control Tower can \u201csee\u201d it in its OU list (some actions are done from Control Tower UI).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Provision a new account using Account Factory<\/h3>\n\n\n\n<p>Now you\u2019ll create a new AWS account in the Sandbox OU.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In AWS Control Tower, open <strong>Account Factory<\/strong>.<\/li>\n<li>Choose <strong>Provision account<\/strong>.<\/li>\n<li>Enter required fields (commonly):\n   &#8211; Account name (e.g., <code>ct-sandbox-1<\/code>)\n   &#8211; Account email (must be unique)\n   &#8211; Target OU (select <code>Sandbox<\/code>)\n   &#8211; SSO user email \/ first user assignment (options vary)<\/li>\n<li>Submit provisioning.<\/li>\n<\/ol>\n\n\n\n<p>Provisioning can take time.<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong> A new AWS account is created, placed in the Sandbox OU, and enrolled\/governed by Control Tower.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Account Factory shows provisioning status as <strong>Succeeded<\/strong> (or similar).\n&#8211; AWS Organizations lists the new account under the Sandbox OU.\n&#8211; In IAM Identity Center, you can assign access (permission sets) to the new account.<\/p>\n\n\n\n<p><strong>Optional CLI verification:<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">aws organizations list-accounts\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Enable one detective control on the Sandbox OU<\/h3>\n\n\n\n<p>You will enable a single detective control so you can observe compliance signals.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In AWS Control Tower console, go to <strong>Controls<\/strong>.<\/li>\n<li>Browse the control library and filter by service or type.<\/li>\n<li>Select <strong>one detective control<\/strong> applicable to general AWS usage (for example, an IAM or S3-related detective control).\n   &#8211; Control names can evolve; choose one that clearly states what it detects.<\/li>\n<li>Choose <strong>Enable control<\/strong> and target the <code>Sandbox<\/code> OU.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> The control is enabled for the OU, and Control Tower starts evaluating compliance in the sandbox account(s).<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Control status shows <strong>Enabled<\/strong> (deployment may take time).\n&#8211; The sandbox account appears as in-scope for that control.<\/p>\n\n\n\n<blockquote>\n<p>If you prefer a purely non-impacting test, use a detective control. Preventive controls can block API actions and disrupt your lab if you choose an overly restrictive one.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8: Trigger a simple noncompliant condition (safe test)<\/h3>\n\n\n\n<p>Your goal is to create a resource or configuration that violates the detective control and then confirm Control Tower reports it.<\/p>\n\n\n\n<p>Because the exact control you chose may differ, use this pattern:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the <strong>sandbox account<\/strong>, create a test condition that violates the selected control.<\/li>\n<li>Example test patterns:\n   &#8211; If you enabled an IAM MFA-related control: create an IAM user without MFA.\n   &#8211; If you enabled an S3 public access-related control: create an S3 bucket with a public ACL\/policy (be careful; avoid exposing real data).<\/li>\n<\/ol>\n\n\n\n<p>Here is a <strong>safe IAM example<\/strong> you can use if you selected an IAM MFA detective control:<\/p>\n\n\n\n<p><strong>In the sandbox account:<\/strong>\n1. Go to <strong>IAM &gt; Users &gt; Create user<\/strong>\n2. Create user: <code>test-no-mfa<\/code>\n3. Give it minimal permissions (or none) and <strong>do not enable MFA<\/strong><\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong> The detective control eventually marks the account as noncompliant for that rule, and Control Tower displays a compliance issue.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; In Control Tower &gt; Controls &gt; view the control compliance details\n&#8211; Optionally, check AWS Config in the sandbox account:\n  &#8211; Go to <strong>AWS Config &gt; Rules<\/strong> and locate the related rule evaluation\n  &#8211; Confirm it shows <strong>NON_COMPLIANT<\/strong> for the relevant resource<\/p>\n\n\n\n<blockquote>\n<p>Timing note: AWS Config evaluations are not always instantaneous. Wait several minutes and re-check.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>Use this checklist to confirm your lab is working end-to-end:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Landing zone active<\/strong> in Control Tower dashboard.<\/li>\n<li><strong>New sandbox account<\/strong> exists in Organizations and appears in Control Tower.<\/li>\n<li><strong>One control enabled<\/strong> for the Sandbox OU.<\/li>\n<li><strong>Compliance signal visible<\/strong>:\n   &#8211; Compliant or noncompliant state displayed for the sandbox account under that control.<\/li>\n<li><strong>Central governance working<\/strong>:\n   &#8211; You can see account structure, OU, and control assignment in Control Tower.<\/li>\n<\/ol>\n\n\n\n<p>Optional deeper validation:\n&#8211; Confirm CloudTrail logs exist in the log archive S3 buckets (do not change bucket policies unless you understand the impact).\n&#8211; Confirm AWS Config is recording in the governed region(s) for the sandbox account.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<p>Common issues and realistic fixes:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Control Tower setup fails due to existing AWS Config\/CloudTrail<\/strong>\n   &#8211; Fix: Align existing org\/account CloudTrail and Config setups with Control Tower requirements.\n   &#8211; In brownfield orgs, consider piloting in a new organization first.<\/p>\n<\/li>\n<li>\n<p><strong>Account provisioning stuck or fails<\/strong>\n   &#8211; Fix: Confirm the account email is unique and reachable.\n   &#8211; Check AWS Organizations service limits (account count) and request quota increases if needed.<\/p>\n<\/li>\n<li>\n<p><strong>Can\u2019t enable a control (permission error)<\/strong>\n   &#8211; Fix: Ensure you\u2019re operating as an admin in the management account.\n   &#8211; Confirm required service-linked roles exist (Control Tower\/Organizations-related).<\/p>\n<\/li>\n<li>\n<p><strong>Control enabled but no compliance data<\/strong>\n   &#8211; Fix: Wait for AWS Config evaluation cycles.\n   &#8211; Confirm the account is enrolled and the region is governed.\n   &#8211; Confirm AWS Config is enabled\/recording in that account\/region (as expected by Control Tower).<\/p>\n<\/li>\n<li>\n<p><strong>Unexpected blocked actions after enabling a preventive control<\/strong>\n   &#8211; Fix: Identify the SCP applied by the control and move the account to a less restrictive OU (temporary), or disable the control.\n   &#8211; Avoid applying restrictive preventive controls to shared or production OUs without change management.<\/p>\n<\/li>\n<li>\n<p><strong>Region confusion<\/strong>\n   &#8211; Fix: Ensure you are using the Control Tower home region for management operations and that your intended regions are added as governed regions (if required).<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>Cleanup depends on how far you want to roll back.<\/p>\n\n\n\n<p><strong>Minimum cleanup (recommended for most learners)<\/strong>\n1. Delete test resources in the sandbox account:\n   &#8211; Delete IAM user <code>test-no-mfa<\/code> (or reverse the test condition)\n   &#8211; Delete any test S3 buckets or policies you created\n2. Disable the elective control you enabled (optional):\n   &#8211; Control Tower &gt; Controls &gt; Disable control from the Sandbox OU<\/p>\n\n\n\n<p><strong>Account cleanup<\/strong>\n&#8211; If you provisioned a sandbox account and no longer need it:\n  1. Remove workloads\/resources inside it (to avoid ongoing service charges).\n  2. Consider <strong>closing the AWS account<\/strong> (AWS Organizations supports closing accounts; closure can take time and has implications).\n  3. Verify the official process for closing member accounts:\n     &#8211; https:\/\/docs.aws.amazon.com\/organizations\/latest\/userguide\/orgs_manage_accounts_close.html<\/p>\n\n\n\n<p><strong>Landing zone cleanup<\/strong>\n&#8211; Decommissioning a landing zone is a significant operation and not always desired. If you must remove Control Tower, follow the official AWS Control Tower documentation for decommission\/reset procedures (process can change\u2014verify in official docs):\n  &#8211; https:\/\/docs.aws.amazon.com\/controltower\/latest\/userguide\/ (navigate to decommission guidance)<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Adopt a clear OU strategy<\/strong> early:<\/li>\n<li>Separate OUs for Production, NonProduction, Sandbox, Shared Services, and Security.<\/li>\n<li><strong>Use multiple accounts as isolation boundaries<\/strong>:<\/li>\n<li>Separate workloads by environment and team to reduce blast radius.<\/li>\n<li><strong>Treat the landing zone as a platform product<\/strong>:<\/li>\n<li>Version changes, controls, and OU restructuring should follow change management.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Use IAM Identity Center permission sets<\/strong> instead of long-lived IAM users.<\/li>\n<li><strong>Minimize management account usage<\/strong>:<\/li>\n<li>Day-to-day work should happen in member accounts with least privilege.<\/li>\n<li><strong>Implement break-glass access<\/strong> carefully:<\/li>\n<li>A tightly controlled emergency admin role with logging and approvals.<\/li>\n<li><strong>Design SCPs deliberately<\/strong>:<\/li>\n<li>Keep SCP strategy readable, version-controlled, and tested in lower environments.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control AWS Config spend<\/strong>:<\/li>\n<li>Enable detective controls intentionally; monitor Config usage as accounts scale.<\/li>\n<li><strong>Manage log retention<\/strong>:<\/li>\n<li>Implement S3 lifecycle policies for CloudTrail logs consistent with compliance.<\/li>\n<li><strong>Avoid unnecessary governed regions<\/strong>:<\/li>\n<li>Each governed region multiplies baseline logging\/compliance cost.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Control Tower is governance-oriented; \u201cperformance\u201d is mainly:<\/li>\n<li>Avoid overly complex, slow-to-remediate control sprawl.<\/li>\n<li>Use automation pipelines for account bootstrapping and application deployment rather than manual steps.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Separate security tooling into dedicated accounts<\/strong> (often the audit account plus additional security tooling accounts as you scale).<\/li>\n<li><strong>Standardize account bootstrapping<\/strong>:<\/li>\n<li>Consider augmenting Account Factory with infrastructure-as-code pipelines.<\/li>\n<li>For advanced account customization at scale, evaluate <strong>Account Factory for Terraform (AFT)<\/strong> (AWS-supported open-source solution; verify current guidance):<ul>\n<li>https:\/\/aws-ia.github.io\/terraform-aws-control_tower_account_factory\/<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Monitor Control Tower events and control deployment status<\/strong> regularly.<\/li>\n<li><strong>Document your governance baseline<\/strong>:<\/li>\n<li>Which controls are mandatory per OU and why.<\/li>\n<li><strong>Create runbooks<\/strong>:<\/li>\n<li>Enrollment failures, provisioning failures, SCP breakages, and compliance exceptions.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Adopt consistent naming:<\/li>\n<li>Account names: <code>team-env-purpose<\/code> (e.g., <code>payments-prod-app<\/code>)<\/li>\n<li>OU names: <code>Production<\/code>, <code>NonProduction<\/code>, <code>Sandbox<\/code>, <code>Security<\/code><\/li>\n<li>Define required tags for cost allocation and ownership:<\/li>\n<li><code>Owner<\/code>, <code>CostCenter<\/code>, <code>Environment<\/code>, <code>DataClassification<\/code><\/li>\n<li>Enforce tags via CI\/CD and policy-as-code; Control Tower controls may not cover all tagging requirements.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use IAM Identity Center for workforce access.<\/li>\n<li>Prefer role-based access via permission sets rather than IAM users.<\/li>\n<li>Limit access to:<\/li>\n<li>Control Tower configuration<\/li>\n<li>Organizations SCP management<\/li>\n<li>Log archive bucket policies and KMS keys (if used)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>CloudTrail logs stored in S3 are typically encrypted (SSE-S3 by default; SSE-KMS optional).<\/li>\n<li>If using SSE-KMS:<\/li>\n<li>Ensure key policies allow log delivery and audit access<\/li>\n<li>Monitor KMS costs and key usage<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Control Tower itself is control-plane oriented; network exposure risk is mostly in:<\/li>\n<li>Misconfigured workloads in member accounts<\/li>\n<li>Public S3 buckets, open security groups, permissive IAM roles<\/li>\n<li>Use controls plus additional security tooling (Security Hub, GuardDuty) for a stronger posture.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Avoid storing credentials in the management account.<\/li>\n<li>Use AWS Secrets Manager or SSM Parameter Store in workload accounts.<\/li>\n<li>Ensure that roles used by pipelines are least-privilege and monitored.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Centralized CloudTrail logs in log archive account are foundational.<\/li>\n<li>Ensure log retention meets compliance requirements.<\/li>\n<li>Restrict deletion permissions on logs; consider immutable storage patterns (for example, S3 Object Lock where appropriate\u2014verify compatibility and design carefully).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Control Tower helps establish consistent controls, but <strong>you are still responsible<\/strong> for:<\/li>\n<li>Selecting controls that map to your frameworks<\/li>\n<li>Evidence collection processes<\/li>\n<li>Exception management and risk acceptance<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Applying overly restrictive preventive controls directly to production without testing.<\/li>\n<li>Allowing broad admin access in workload accounts with no session controls.<\/li>\n<li>Not monitoring AWS Config\/CloudTrail costs and disabling them \u201cto save money\u201d (breaking governance).<\/li>\n<li>Treating Control Tower as a complete security solution (it\u2019s a foundation, not the entire program).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Start with a minimal viable landing zone and scale controls gradually.<\/li>\n<li>Use a dedicated Security OU and central security accounts.<\/li>\n<li>Use OU-based control sets aligned to environment sensitivity.<\/li>\n<li>Integrate with Security Hub\/GuardDuty for comprehensive detection (optional but common).<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<p>AWS Control Tower is highly useful, but you should plan around these realities.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Known limitations (common categories)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Opinionated architecture<\/strong>: You must align with Control Tower\u2019s landing zone model.<\/li>\n<li><strong>Brownfield complexity<\/strong>: Enrolling existing accounts can require remediation if they have conflicting baseline services.<\/li>\n<li><strong>Not all governance needs are covered<\/strong> by built-in controls; custom SCPs\/config rules\/policy-as-code may still be needed.<\/li>\n<li><strong>Control evaluation timing<\/strong>: Detective controls may take time to reflect compliance changes.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS Organizations limits (accounts, OUs).<\/li>\n<li>Control Tower limits for number of controls enabled and account enrollments (varies; check docs and Service Quotas):<\/li>\n<li>https:\/\/docs.aws.amazon.com\/controltower\/latest\/userguide\/limits.html (verify)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Regional constraints<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Not available in every region.<\/li>\n<li>Feature availability can differ by region; always confirm in official docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing surprises<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS Config can become expensive at scale if you enable many detective controls across many accounts\/regions.<\/li>\n<li>CloudTrail data events can spike costs if enabled broadly.<\/li>\n<li>Log archive S3 growth without lifecycle policies increases long-term spend.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compatibility issues<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Existing organization-wide CloudTrail patterns may need rework.<\/li>\n<li>Existing AWS Config setups can conflict with Control Tower expected configuration.<\/li>\n<li>Certain customizations can be overwritten or cause drift when updating the landing zone.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational gotchas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>SCP misunderstandings<\/strong>: SCPs don\u2019t grant permissions; they only restrict.<\/li>\n<li><strong>Management account hygiene<\/strong>: Running workloads in the management account is strongly discouraged.<\/li>\n<li><strong>Email uniqueness<\/strong>: Account creation requires unique emails; plan ahead for large orgs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Migration challenges<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Mapping existing accounts into new OUs and applying controls can uncover noncompliance.<\/li>\n<li>Separating shared resources from single-account designs into multi-account architecture can take time.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Vendor-specific nuances<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Control Tower is AWS-native and tightly integrated with Organizations and Identity Center. If you need cross-cloud governance, you\u2019ll still need external tooling and processes.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<p>AWS Control Tower is one option in AWS\u2019s governance toolkit. Here\u2019s how it compares.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>AWS Control Tower<\/strong><\/td>\n<td>Standardized multi-account landing zone with governance<\/td>\n<td>Fast landing zone setup, built-in controls, account factory, AWS-native<\/td>\n<td>Opinionated; brownfield enrollment can be complex; underlying service costs<\/td>\n<td>You want an AWS-supported landing zone and OU-based governance quickly<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Organizations (DIY)<\/strong><\/td>\n<td>Teams that want full control over org structure and SCPs<\/td>\n<td>Maximum flexibility, minimal \u201copinionated\u201d setup<\/td>\n<td>You must build logging, config, identity, account vending yourself<\/td>\n<td>You already have a mature platform team and want a custom governance architecture<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Config (DIY)<\/strong><\/td>\n<td>Configuration compliance and drift detection<\/td>\n<td>Powerful compliance engine, custom rules possible<\/td>\n<td>Requires design and operations; doesn\u2019t solve account vending<\/td>\n<td>You need compliance checks without full landing zone orchestration<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Service Catalog (DIY)<\/strong><\/td>\n<td>Standardized product provisioning (including accounts via custom automation)<\/td>\n<td>Good for controlled provisioning<\/td>\n<td>Not a landing zone; you still need governance baseline<\/td>\n<td>You have a mature catalog strategy and don\u2019t need Control Tower\u2019s landing zone<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Landing Zone (legacy solution)<\/strong><\/td>\n<td>Historical predecessor approach<\/td>\n<td>Was a reference solution<\/td>\n<td>Superseded by Control Tower; avoid new deployments<\/td>\n<td>Only relevant for legacy environments; prefer Control Tower for new work<\/td>\n<\/tr>\n<tr>\n<td><strong>Terraform + custom modules + SCPs<\/strong><\/td>\n<td>Platform teams standardizing via IaC<\/td>\n<td>Full customization; version control<\/td>\n<td>Higher engineering\/ops burden<\/td>\n<td>You need heavy customization and can invest in building\/operating it<\/td>\n<\/tr>\n<tr>\n<td><strong>Azure Landing Zones + Azure Policy<\/strong><\/td>\n<td>Microsoft Azure governance<\/td>\n<td>Strong Azure-native governance<\/td>\n<td>Not AWS<\/td>\n<td>Multi-cloud orgs using Azure for those workloads<\/td>\n<\/tr>\n<tr>\n<td><strong>Google Cloud Landing Zone + Org Policy<\/strong><\/td>\n<td>Google Cloud governance<\/td>\n<td>Strong GCP-native governance<\/td>\n<td>Not AWS<\/td>\n<td>Multi-cloud orgs using GCP for those workloads<\/td>\n<\/tr>\n<tr>\n<td><strong>Cloud Custodian (open source)<\/strong><\/td>\n<td>Policy-as-code across clouds (detection\/remediation)<\/td>\n<td>Flexible rules, automation<\/td>\n<td>Requires operations; doesn\u2019t replace Organizations\/landing zone<\/td>\n<td>You need custom policies\/remediation beyond built-in controls<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example (regulated, multi-team)<\/h3>\n\n\n\n<p><strong>Problem<\/strong>\nA financial services company has 80+ AWS accounts across regions. Logging is inconsistent, access patterns differ by business unit, and auditors require centralized evidence for changes and actions.<\/p>\n\n\n\n<p><strong>Proposed architecture<\/strong>\n&#8211; Deploy AWS Control Tower in a designated home region.\n&#8211; Establish core accounts:\n  &#8211; Management account for governance only\n  &#8211; Log Archive account for centralized CloudTrail\/S3 logs\n  &#8211; Audit account for security investigations and read-only access\n&#8211; Create OUs:\n  &#8211; <code>Security<\/code>, <code>SharedServices<\/code>, <code>Production<\/code>, <code>NonProduction<\/code>, <code>Sandbox<\/code>\n&#8211; Apply OU-based control sets:\n  &#8211; Production: strict preventive + detective controls\n  &#8211; NonProduction: moderate controls\n  &#8211; Sandbox: strong cost and security constraints\n&#8211; Integrate IAM Identity Center with corporate IdP and assign permission sets per role.\n&#8211; Add Security Hub and GuardDuty organization-wide for enhanced detection (optional layer).<\/p>\n\n\n\n<p><strong>Why AWS Control Tower was chosen<\/strong>\n&#8211; The company needs an AWS-supported landing zone and standardized governance quickly.\n&#8211; OU-based controls map cleanly to environment tiers and audit requirements.\n&#8211; Centralized logging and config history provide evidence for compliance.<\/p>\n\n\n\n<p><strong>Expected outcomes<\/strong>\n&#8211; Faster audit response with centralized logs.\n&#8211; Reduced drift across accounts.\n&#8211; Standardized onboarding for new teams and projects.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example (scaling from 1 to many accounts)<\/h3>\n\n\n\n<p><strong>Problem<\/strong>\nA SaaS startup started in one AWS account. As the team grows, environments collide, permissions are too broad, and a security review flags lack of centralized logging and separation of duties.<\/p>\n\n\n\n<p><strong>Proposed architecture<\/strong>\n&#8211; Adopt AWS Control Tower early:\n  &#8211; Keep management account clean\n  &#8211; Create separate prod and non-prod accounts\n  &#8211; Add a sandbox account for experiments\n&#8211; Use IAM Identity Center for access; eliminate IAM users.\n&#8211; Enable a small set of high-value controls (start small to manage AWS Config cost).\n&#8211; Add S3 lifecycle policies for log retention to keep costs predictable.<\/p>\n\n\n\n<p><strong>Why AWS Control Tower was chosen<\/strong>\n&#8211; The team is small and can\u2019t maintain a bespoke landing zone.\n&#8211; Control Tower provides a prescriptive baseline and account vending quickly.<\/p>\n\n\n\n<p><strong>Expected outcomes<\/strong>\n&#8211; Clear account boundaries (prod vs dev vs sandbox).\n&#8211; Better security posture with centralized logs.\n&#8211; Scalable governance as the company grows.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Is AWS Control Tower the same as AWS Organizations?<\/strong><br\/>\n   No. AWS Organizations provides the account and OU structure (and SCPs). AWS Control Tower orchestrates Organizations plus Identity Center, Config, CloudTrail, and controls to deliver a governed landing zone.<\/p>\n<\/li>\n<li>\n<p><strong>Does AWS Control Tower cost money?<\/strong><br\/>\n   AWS commonly states there is no additional charge for Control Tower itself, but you pay for underlying services like AWS Config, CloudTrail, S3, and CloudWatch. See: https:\/\/aws.amazon.com\/controltower\/pricing\/<\/p>\n<\/li>\n<li>\n<p><strong>What is a landing zone?<\/strong><br\/>\n   A landing zone is a standardized multi-account AWS environment with core accounts, centralized logging, and governance controls to support secure scaling.<\/p>\n<\/li>\n<li>\n<p><strong>What are \u201ccontrols\u201d (guardrails) in Control Tower?<\/strong><br\/>\n   Controls are governance policies you enable on OUs\/accounts. They can be preventive (SCP), detective (Config), and sometimes proactive (pre-deployment validation; verify per control).<\/p>\n<\/li>\n<li>\n<p><strong>Can I use AWS Control Tower with existing accounts?<\/strong><br\/>\n   Yes, through account enrollment. However, existing configurations (CloudTrail\/Config\/IAM) may require remediation to align with Control Tower baselines.<\/p>\n<\/li>\n<li>\n<p><strong>Do preventive controls replace IAM policies?<\/strong><br\/>\n   No. SCPs restrict maximum permissions but do not grant access. You still design IAM roles\/permission sets to grant needed access.<\/p>\n<\/li>\n<li>\n<p><strong>What are the core accounts Control Tower creates?<\/strong><br\/>\n   Commonly an Audit account and a Log Archive account, plus the Organizations management account. Exact behavior can vary; confirm in your setup workflow.<\/p>\n<\/li>\n<li>\n<p><strong>Can I customize the landing zone heavily?<\/strong><br\/>\n   Control Tower is opinionated. You can extend it, but heavy customization can increase operational complexity and can be affected by landing zone updates.<\/p>\n<\/li>\n<li>\n<p><strong>How long does it take to provision an account with Account Factory?<\/strong><br\/>\n   Often tens of minutes, but it varies. Account creation, enrollment, and baseline configuration are not instantaneous.<\/p>\n<\/li>\n<li>\n<p><strong>How do I prevent teams from using unauthorized regions?<\/strong><br\/>\n   Typically via SCP-based restrictions (which may be part of your governance strategy and\/or available controls). Confirm current best practices in AWS docs.<\/p>\n<\/li>\n<li>\n<p><strong>Why is AWS Config such a big cost driver?<\/strong><br\/>\n   Detective controls rely on Config recording and rule evaluations across accounts and regions. At scale, evaluation volume can become significant.<\/p>\n<\/li>\n<li>\n<p><strong>Can Control Tower manage networking (VPCs, subnets) for me?<\/strong><br\/>\n   Not directly. Control Tower governs accounts and baseline security\/logging. Networking is usually handled via separate IaC, shared services accounts, and patterns like Transit Gateway.<\/p>\n<\/li>\n<li>\n<p><strong>Can I integrate IAM Identity Center with my corporate directory?<\/strong><br\/>\n   Yes, IAM Identity Center supports external identity providers. Design and rollout should be carefully planned for enterprise environments.<\/p>\n<\/li>\n<li>\n<p><strong>Is AWS Control Tower suitable for single-account setups?<\/strong><br\/>\n   Usually no. Its value is primarily in multi-account governance and standardization.<\/p>\n<\/li>\n<li>\n<p><strong>What\u2019s the difference between detective and preventive controls?<\/strong><br\/>\n   Detective controls detect noncompliance and report it (often via Config). Preventive controls block noncompliant actions (often via SCP).<\/p>\n<\/li>\n<li>\n<p><strong>Do I still need Security Hub\/GuardDuty if I use Control Tower?<\/strong><br\/>\n   Often yes. Control Tower is a governance foundation; Security Hub\/GuardDuty add threat detection and security findings aggregation.<\/p>\n<\/li>\n<li>\n<p><strong>How do I estimate Control Tower costs?<\/strong><br\/>\n   Model underlying services per account\/region (Config, CloudTrail, S3 storage) and multiply by account count and governed regions. Use AWS Pricing Calculator: https:\/\/calculator.aws\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn AWS Control Tower<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official product page<\/td>\n<td>AWS Control Tower<\/td>\n<td>Overview, core concepts, entry points to docs: https:\/\/aws.amazon.com\/controltower\/<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>AWS Control Tower User Guide<\/td>\n<td>Authoritative setup, controls, enrollment, and operations guidance: https:\/\/docs.aws.amazon.com\/controltower\/latest\/userguide\/what-is-control-tower.html<\/td>\n<\/tr>\n<tr>\n<td>Official pricing<\/td>\n<td>AWS Control Tower Pricing<\/td>\n<td>Confirms pricing model and cost responsibility: https:\/\/aws.amazon.com\/controltower\/pricing\/<\/td>\n<\/tr>\n<tr>\n<td>Official docs<\/td>\n<td>AWS Organizations User Guide<\/td>\n<td>Essential for OU\/SCP\/account lifecycle concepts: https:\/\/docs.aws.amazon.com\/organizations\/latest\/userguide\/orgs_introduction.html<\/td>\n<\/tr>\n<tr>\n<td>Official docs<\/td>\n<td>IAM Identity Center docs<\/td>\n<td>Access management patterns used with Control Tower: https:\/\/docs.aws.amazon.com\/singlesignon\/latest\/userguide\/what-is.html<\/td>\n<\/tr>\n<tr>\n<td>Official docs<\/td>\n<td>AWS Config Developer Guide<\/td>\n<td>Understand detective controls and compliance evaluation costs: https:\/\/docs.aws.amazon.com\/config\/latest\/developerguide\/WhatIsConfig.html<\/td>\n<\/tr>\n<tr>\n<td>Official docs<\/td>\n<td>AWS CloudTrail User Guide<\/td>\n<td>Central logging fundamentals: https:\/\/docs.aws.amazon.com\/awscloudtrail\/latest\/userguide\/cloudtrail-user-guide.html<\/td>\n<\/tr>\n<tr>\n<td>Whitepaper<\/td>\n<td>Organizing Your AWS Environment Using Multiple Accounts<\/td>\n<td>Multi-account strategy guidance (highly relevant): https:\/\/docs.aws.amazon.com\/whitepapers\/latest\/organizing-your-aws-environment\/organizing-your-aws-environment.html<\/td>\n<\/tr>\n<tr>\n<td>AWS Well-Architected<\/td>\n<td>AWS Well-Architected Framework<\/td>\n<td>Governance and operational excellence context: https:\/\/docs.aws.amazon.com\/wellarchitected\/latest\/framework\/welcome.html<\/td>\n<\/tr>\n<tr>\n<td>Official open-source<\/td>\n<td>Account Factory for Terraform (AFT)<\/td>\n<td>Automate account provisioning\/customization at scale (verify suitability): https:\/\/aws-ia.github.io\/terraform-aws-control_tower_account_factory\/<\/td>\n<\/tr>\n<tr>\n<td>Workshops<\/td>\n<td>AWS Workshops Catalog<\/td>\n<td>Search for Control Tower workshops and labs: https:\/\/workshops.aws\/<\/td>\n<\/tr>\n<tr>\n<td>Videos<\/td>\n<td>AWS YouTube Channel<\/td>\n<td>Re:Invent sessions and service deep dives: https:\/\/www.youtube.com\/@amazonwebservices<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>DevOpsSchool.com<\/strong><br\/>\n   &#8211; <strong>Suitable audience:<\/strong> DevOps engineers, SREs, cloud engineers, platform teams<br\/>\n   &#8211; <strong>Likely learning focus:<\/strong> AWS platform engineering, multi-account governance concepts, DevOps practices<br\/>\n   &#8211; <strong>Mode:<\/strong> Check website<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopsschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>ScmGalaxy.com<\/strong><br\/>\n   &#8211; <strong>Suitable audience:<\/strong> DevOps and SCM learners, engineers transitioning into cloud\/DevOps<br\/>\n   &#8211; <strong>Likely learning focus:<\/strong> SCM\/CI\/CD foundations, DevOps workflows that complement governance<br\/>\n   &#8211; <strong>Mode:<\/strong> Check website<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/www.scmgalaxy.com\/<\/p>\n<\/li>\n<li>\n<p><strong>CLoudOpsNow.in<\/strong><br\/>\n   &#8211; <strong>Suitable audience:<\/strong> Cloud operations engineers, cloud admins, DevOps practitioners<br\/>\n   &#8211; <strong>Likely learning focus:<\/strong> Cloud operations, monitoring, operational governance<br\/>\n   &#8211; <strong>Mode:<\/strong> Check website<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/www.cloudopsnow.in\/<\/p>\n<\/li>\n<li>\n<p><strong>SreSchool.com<\/strong><br\/>\n   &#8211; <strong>Suitable audience:<\/strong> SREs, reliability engineers, operations-focused cloud teams<br\/>\n   &#8211; <strong>Likely learning focus:<\/strong> Reliability, incident management, operational maturity that aligns with governance goals<br\/>\n   &#8211; <strong>Mode:<\/strong> Check website<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/www.sreschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>AiOpsSchool.com<\/strong><br\/>\n   &#8211; <strong>Suitable audience:<\/strong> Ops teams exploring AIOps, monitoring automation, IT operations analytics<br\/>\n   &#8211; <strong>Likely learning focus:<\/strong> AIOps concepts, operational analytics, tooling practices<br\/>\n   &#8211; <strong>Mode:<\/strong> Check website<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/www.aiopsschool.com\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>RajeshKumar.xyz<\/strong><br\/>\n   &#8211; <strong>Likely specialization:<\/strong> DevOps\/cloud training content (verify specific course offerings on site)<br\/>\n   &#8211; <strong>Suitable audience:<\/strong> Beginners to intermediate learners seeking guided training<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/rajeshkumar.xyz\/<\/p>\n<\/li>\n<li>\n<p><strong>devopstrainer.in<\/strong><br\/>\n   &#8211; <strong>Likely specialization:<\/strong> DevOps training and coaching (verify specific AWS governance coverage)<br\/>\n   &#8211; <strong>Suitable audience:<\/strong> DevOps engineers and cloud learners<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopstrainer.in\/<\/p>\n<\/li>\n<li>\n<p><strong>devopsfreelancer.com<\/strong><br\/>\n   &#8211; <strong>Likely specialization:<\/strong> DevOps freelancing and support\/training resources (verify services on site)<br\/>\n   &#8211; <strong>Suitable audience:<\/strong> Teams\/individuals looking for practical DevOps guidance<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopsfreelancer.com\/<\/p>\n<\/li>\n<li>\n<p><strong>devopssupport.in<\/strong><br\/>\n   &#8211; <strong>Likely specialization:<\/strong> DevOps support services and learning resources (verify scope on site)<br\/>\n   &#8211; <strong>Suitable audience:<\/strong> Engineers needing hands-on operational support<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopssupport.in\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>cotocus.com<\/strong><br\/>\n   &#8211; <strong>Likely service area:<\/strong> Cloud\/DevOps consulting (verify exact offerings on website)<br\/>\n   &#8211; <strong>Where they may help:<\/strong> Governance rollout planning, AWS platform setup, operational processes<br\/>\n   &#8211; <strong>Consulting use case examples:<\/strong> Designing multi-account OU strategy; implementing baseline logging; governance runbooks<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/cotocus.com\/<\/p>\n<\/li>\n<li>\n<p><strong>DevOpsSchool.com<\/strong><br\/>\n   &#8211; <strong>Likely service area:<\/strong> DevOps and cloud consulting\/training services (verify current service catalog)<br\/>\n   &#8211; <strong>Where they may help:<\/strong> Platform engineering enablement, DevOps process adoption, AWS operations practices<br\/>\n   &#8211; <strong>Consulting use case examples:<\/strong> Building an account vending workflow; integrating IAM Identity Center access patterns; cost governance practices<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopsschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>DEVOPSCONSULTING.IN<\/strong><br\/>\n   &#8211; <strong>Likely service area:<\/strong> DevOps consulting and implementation support (verify exact offerings)<br\/>\n   &#8211; <strong>Where they may help:<\/strong> DevOps operating model, CI\/CD design, operational readiness aligned with governance<br\/>\n   &#8211; <strong>Consulting use case examples:<\/strong> Implementing policy-as-code guardrails in pipelines; operational monitoring for multi-account environments<br\/>\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopsconsulting.in\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before AWS Control Tower<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS basics: IAM, VPC, EC2, S3, CloudWatch<\/li>\n<li>AWS Organizations fundamentals: accounts, OUs, SCPs<\/li>\n<li>Identity basics: roles vs users, federation concepts<\/li>\n<li>Logging and audit basics: CloudTrail, Config, S3 log storage patterns<\/li>\n<li>Infrastructure as Code basics: CloudFormation or Terraform (recommended)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after AWS Control Tower<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Advanced governance:<\/li>\n<li>SCP design patterns, permission boundaries, delegated admin models<\/li>\n<li>Security services:<\/li>\n<li>Security Hub, GuardDuty, IAM Access Analyzer, Firewall Manager<\/li>\n<li>Centralized networking:<\/li>\n<li>Transit Gateway, centralized egress\/inspection, shared services accounts<\/li>\n<li>Platform automation:<\/li>\n<li>Account Factory for Terraform (AFT), CI\/CD pipelines for account bootstrapping<\/li>\n<li>Observability at scale:<\/li>\n<li>Central log analytics, SIEM integration, CloudTrail Lake (if needed)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud platform engineer<\/li>\n<li>Cloud solutions architect<\/li>\n<li>DevOps engineer \/ SRE (platform side)<\/li>\n<li>Cloud security engineer<\/li>\n<li>Governance, risk, and compliance (GRC) technologist<\/li>\n<li>Cloud operations manager<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (AWS)<\/h3>\n\n\n\n<p>AWS Control Tower is not typically a standalone certification topic, but it aligns strongly with:\n&#8211; AWS Certified Solutions Architect \u2013 Associate\/Professional\n&#8211; AWS Certified SysOps Administrator \u2013 Associate\n&#8211; AWS Certified Security \u2013 Specialty\n&#8211; AWS Certified Advanced Networking \u2013 Specialty (for large org network architectures)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Build a multi-OU organization (Prod\/NonProd\/Sandbox) and document a control strategy per OU.<\/li>\n<li>Implement account provisioning + bootstrapping:<\/li>\n<li>New account created \u2192 baseline IAM roles \u2192 baseline VPC \u2192 logging \u2192 CI\/CD runner<\/li>\n<li>Cost governance project:<\/li>\n<li>Tagging policy + budgets\/alerts + SCP restrictions for expensive services in sandbox<\/li>\n<li>Security governance project:<\/li>\n<li>Enable Security Hub\/GuardDuty org-wide and centralize findings in the audit account<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Account Factory:<\/strong> Control Tower\u2019s standardized workflow (backed by Service Catalog) to provision new AWS accounts into OUs with baseline configuration.<\/li>\n<li><strong>AWS Organizations:<\/strong> Service used to manage multiple AWS accounts centrally, including OUs and SCPs.<\/li>\n<li><strong>Audit account:<\/strong> A dedicated account commonly used for security\/audit read access and investigations.<\/li>\n<li><strong>Control (Guardrail):<\/strong> A governance rule applied to an OU or account. Can be preventive (SCP), detective (Config), or proactive (pre-deployment validation; verify per control).<\/li>\n<li><strong>Detective control:<\/strong> Detects and reports noncompliance (often via AWS Config).<\/li>\n<li><strong>Governed regions:<\/strong> Regions where Control Tower governance (logging\/compliance expectations) is applied. Confirm exact behavior in official docs.<\/li>\n<li><strong>IAM Identity Center:<\/strong> AWS service (formerly AWS Single Sign-On) used for centralized workforce authentication and authorization via permission sets.<\/li>\n<li><strong>Landing zone:<\/strong> A standardized, governed multi-account AWS environment designed for secure scaling.<\/li>\n<li><strong>Log archive account:<\/strong> A dedicated account for centralized log storage (commonly S3 buckets for CloudTrail and other logs).<\/li>\n<li><strong>Management account:<\/strong> The AWS Organizations management account (formerly \u201cmaster account\u201d) that administers the organization and often hosts Control Tower.<\/li>\n<li><strong>OU (Organizational Unit):<\/strong> A logical grouping of AWS accounts within AWS Organizations used for policy inheritance.<\/li>\n<li><strong>Preventive control:<\/strong> Prevents disallowed actions (often via SCP denies).<\/li>\n<li><strong>SCP (Service Control Policy):<\/strong> Organization policy that sets the maximum available permissions for accounts\/OUs; it restricts actions but does not grant permissions.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p>AWS Control Tower is an AWS <strong>Management and governance<\/strong> service that helps you set up and operate a governed multi-account AWS environment (a landing zone). It standardizes account provisioning (Account Factory), centralizes audit logging, and applies scalable governance through controls across OUs and accounts.<\/p>\n\n\n\n<p>It matters because multi-account AWS is the most common path to secure scaling\u2014but it\u2019s hard to do consistently without a prescriptive foundation. Cost-wise, Control Tower itself is typically not the direct cost driver; <strong>AWS Config, CloudTrail, S3 log storage, and governed-region\/account scale<\/strong> are where recurring costs appear. Security-wise, it strengthens your baseline through centralized logging, OU-based preventive policies, and continuous compliance signals\u2014while still requiring you to design IAM, SCP strategy, and operational processes responsibly.<\/p>\n\n\n\n<p>Use AWS Control Tower when you want an AWS-supported landing zone and scalable governance. Avoid it if you need extreme customization and are prepared to operate a fully bespoke governance system. Next, deepen your skills by mastering AWS Organizations\/SCP design and extending account provisioning with infrastructure-as-code and automation (for example, AFT where appropriate).<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Management and governance<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,33],"tags":[],"class_list":["post-261","post","type-post","status-publish","format-standard","hentry","category-aws","category-management-and-governance"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/261","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=261"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/261\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=261"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=261"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=261"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}