AWS Control Tower

Sets up and governs a multi-account AWS environment (a landing zone) for you.

Think of it as: A developer who builds the whole apartment complex to code, then inspects it regularly.

What to know for Level 0

Control Tower builds a landing zone, the AWS-recommended multi-account setup, by setting up Organizations, IAM Identity Center, CloudTrail and AWS Config for you. It manages them; it doesn't replace them.
If someone changes something Control Tower manages by hand (one of its SCPs, say), Control Tower reports drift so the setup can be repaired.
Accounts that existed before Control Tower can be enrolled, which applies the landing zone's logging, guardrails and sign-in to them.

More detail

From the management account, Control Tower uses Organizations, IAM Identity Center, CloudTrail, AWS Config and Service Catalog to build a landing zone. It then keeps it governed: Account Factory creates new accounts from a template, controls (guardrails) apply rules across OUs, and a dashboard shows anything noncompliant. If someone changes the setup by hand, Control Tower reports it as drift.

Quiz yourself on AWS Control Tower →

← All terms