AWS Control Tower provides you with a single location to set up a well architected multi-account environment to govern your AWS workloads with rules for security, operations, and compliance.

The Control Tower dashboard gives you continuous visibility into your AWS environment. You can view the number of OUs and accounts provisioned, the number of guardrails enabled, and the check the status of your OUs and accounts against those guardrails. You can also see a list of noncompliant resources with respect to enabled guardrails.

Dashboard

Guardrails are pre-packaged governance rules for security, operations, and compliance that customers can select and apply enterprise-wide or to specific groups of accounts. A guardrail is expressed in plain English, and enforces a specific governance policy for your AWS environment that can be enabled within an AWS Organizations organizational unit (OU). Each guardrail contains two dimensions: it can be either preventive or detective, and it can be either mandatory or optional. Preventive guardrails establish intent and prevent deployment of resources that donât conform to your policies (for example enable AWS CloudTrail in all accounts). Detective guardrails (disallow public read access for S3 buckets) continuously monitor deployed resources for nonconformance.

Guardrails

The account factory automates provisioning of new accounts in your organization. As a configurable account template, it helps you standardize the provisioning of new accounts with pre-approved account configurations. You can configure your account factory with pre-approved network configuration and region selections. And you can enable self-service for your builders to configure and provision new accounts using AWS Service Catalog.

Account Factory

A landing zone is a well-architected, multi-account AWS environment that's based on security and compliance best practices. AWS Control Tower automates the setup of a new landing zone using best-practices blueprints for identity, federated access, and account structure. The landing zone set up by AWS Control Tower is managed using a set of mandatory and strongly recommended guardrails, which customers select through a self-service console experience to ensure accounts and configurations comply with your policies.

Control Tower
Management & Governance

Overview

Key Features

Links

Related Services

Amazon VPC

Elastic Load Balancing

Amazon EBS

Modern BDD Test Automation with Playwright, Typescript

AWS Cloud Mastery

Control TowerManagement & Governance