Controls (guardrails)

Control Tower's rules for every account in an OU. Some block, some report, some check before deploying.

Think of it as: Locked doors, CCTV, and a plan check before building work starts.

What to know for Level 0

Preventive controls are SCPs: they stop something happening. Detective controls are AWS Config rules: they spot it afterwards and report it. Proactive controls are CloudFormation hooks: they check a resource before CloudFormation creates it.
Exam wording: "must never be possible" or "block" means preventive; "find out when", "report on" or "be told" means detective.
Each control is mandatory (always on), strongly recommended or elective. You turn the optional ones on per OU.

Preventive controls are SCPs. They stop an action from happening, e.g. any request outside approved Regions.
Detective controls are AWS Config rules. They spot something after it happens, e.g. a public S3 bucket.
Proactive controls are CloudFormation hooks. They check resources before CloudFormation creates them.

Each control is also mandatory (always on), strongly recommended or elective.