Day 0 again, but Control Tower does the work

Control Tower builds a landing zone: OUs, Log Archive and Audit accounts, sign-in, logging and guardrails. Then watch a preventive and a detective control in action.

Text version of this diagram.

What sits where:

AWS Organization: A group of AWS accounts with one owner (the management account) and one combined bill. contains:
- Management account · 111111111111: The account that owns the organization and pays the bill. Keep apps out of it. The 12-digit number is its account ID. contains:
  - Control Tower (builds the landing zone): Sets up a well-run multi-account AWS for you (a landing zone), then keeps checking it stays that way.
  - IAM Identity Center (built-in directory): Where people sign in to AWS every day: one login with MFA, then you pick an account and get a role in it. Here it keeps its own list of users, its built-in directory.
  - AWS Organizations (OUs + SCPs): Groups many AWS accounts under one owner and one bill. OUs (organizational units) are folders of accounts. SCPs (service control policies) are rules that cap what those accounts are allowed to do.
  - Controls (guardrails): Control Tower's rules, called guardrails. Some block things before they happen; others spot problems afterwards and report them.
  - Account Factory (accounts from a template): Control Tower's way to make a new AWS account that arrives with logging, guardrails and sign-in already set up.
  - CloudTrail (organization trail): AWS's activity log: who did what, when and from where. An organization trail records every account in one place.
- Workloads OU: An OU (organizational unit) is a folder of accounts. This one holds the accounts that run Todo.io. contains:
  - Prod · 222222222222: Production: the AWS account where the real Todo.io runs for real users. The 12-digit number is its account ID. contains:
    - us-east-1: A Region is a part of the world where AWS has data centers. Most things you build live in one Region. us-east-1 is in northern Virginia. contains:
      - Todo.io stack (VPC, app, database (tab 2)): Everything that runs Todo.io: its private network (VPC), the app and the database. The Design Todo.io tab walks through it.
    - Admin role (AWSAdministratorAccess): A role is a set of permissions you step into for a while, with temporary keys. AWSAdministratorAccess is the permission set Control Tower made that allows everything.
  - Dev · 333333333333: Development: a separate AWS account for experiments, so a mistake there can't touch Prod. contains:
    - S3 bucket (made public by mistake): A named container for files in Amazon S3, AWS's file storage. This one was opened to the whole internet by mistake.
    - AWS Config (records resource settings): Keeps a history of how your resources are set up and checks them against rules, flagging any that break one.
- Security OU: An OU (organizational unit) is a folder of accounts. This one holds the shared security accounts. contains:
  - Log Archive · 444444444444: A separate account that only stores logs, so someone who breaks into Prod can't erase them. contains:
    - S3 bucket (every account’s logs): A named container for files in Amazon S3, AWS's file storage. This one collects the logs of every account.
  - Audit · 555555555555: A separate account for the security team, who can look across every account from here. contains:
    - Security notifications (findings from every account): Problems found in any account are gathered here, so the security team sees them in one place.
You (Ryan) (laptop + browser)

Steps, in order:

Open Control Tower. Path: You (Ryan) → Control Tower. In the management account (root locked away, as in Day 0) you open AWS Control Tower and ask it to build a landing zone: a ready-made, well-run multi-account setup.
Organization and OUs. Path: Control Tower → AWS Organizations. It sets up AWS Organizations with two organizational units (OUs): Security, for shared accounts, and a second one for Todo.io itself. Control Tower suggests the name Sandbox; you call it Workloads.
Two shared accounts. Path: AWS Organizations. In the Security OU it creates Log Archive, where every log ends up, and Audit, where the security team can look across every account.
All logs in one place. Path: CloudTrail → S3 bucket. An organization trail in CloudTrail and AWS Config recordings from every account land in an S3 bucket in Log Archive.
Sign-in, built in. Path: Control Tower → IAM Identity Center. It sets up IAM Identity Center with its built-in directory, plus ready-made groups and permission sets. You create user ryan with MFA.
Create Prod and Dev. Path: Account Factory. Account Factory creates Prod and Dev in the Workloads OU from a standard template. Each arrives with logging, guardrails and sign-in already set up, and ryan gets AdministratorAccess in both.
Guardrails switched on. Path: Controls. Controls are the guardrails. Mandatory ones are always on, such as protecting the log archive. You also turn on Region deny, plus a recommended control that flags public S3 buckets.
Sign in and work. Path: You (Ryan) → IAM Identity Center → Admin role. You sign in at the access portal with MFA, pick Prod and get the AdministratorAccess role, with temporary credentials as always.
A preventive control says no. Path: Admin role → Controls. You try to launch an instance in eu-west-1. Region deny is an SCP, so the request is refused before anything gets created. Checks: scp: Region deny: eu-west-1 is not allowed → deny.
A detective control notices. Path: S3 bucket → AWS Config. In Dev, someone makes an S3 bucket public. A detective control can't stop that, but AWS Config sees the change and marks the bucket noncompliant. Checks: config: s3-bucket-public-read-prohibited: NON_COMPLIANT → flag.
The security team hears about it. Path: AWS Config → Security notifications. The finding is collected in the Audit account and appears on the Control Tower dashboard, so someone can fix it.

Step 1 of 11

In the management account (root locked away, as in Day 0) you open AWS Control Tower and ask it to build a landing zone: a ready-made, well-run multi-account setup.
Show me the real thing
What you fill in
```
Home Region:          us-east-1
Region deny:          Enabled (only us-east-1 allowed)
Additional OU name:   Workloads
Log Archive email:    aws-logs@todo.io
Audit email:          aws-audit@todo.io
IAM Identity Center:  Managed by Control Tower
```
Exam tipControl Tower doesn't replace Organizations, Identity Center, CloudTrail or Config. It sets them up for you and keeps them from drifting.
It sets up AWS Organizations with two organizational units (OUs): Security, for shared accounts, and a second one for Todo.io itself. Control Tower suggests the name Sandbox; you call it Workloads.
Exam tipAn OU is a folder of accounts. Attach an SCP or control to the OU and every account inside gets it.
In the Security OU it creates Log Archive, where every log ends up, and Audit, where the security team can look across every account.
Exam tipNobody runs apps in these accounts. With the logs kept separately, someone who breaks into Prod can't erase the evidence.
An organization trail in CloudTrail and AWS Config recordings from every account land in an S3 bucket in Log Archive.
Show me the real thing
The bucket
```
s3://aws-controltower-logs-444444444444-us-east-1
```
Exam tipThis fixes the shortcut in the manual Day 0, which kept the logs in the management account.
It sets up IAM Identity Center with its built-in directory, plus ready-made groups and permission sets. You create user ryan with MFA.
Exam tipIdentity Center can use Okta, Microsoft Entra ID or Active Directory instead of its own directory (Level 3). The access portal works the same either way.
Account Factory creates Prod and Dev in the Workloads OU from a standard template. Each arrives with logging, guardrails and sign-in already set up, and ryan gets AdministratorAccess in both.
Exam tipAccounts that Control Tower governs are called enrolled. Existing accounts can be enrolled too.
Controls are the guardrails. Mandatory ones are always on, such as protecting the log archive. You also turn on Region deny, plus a recommended control that flags public S3 buckets.
Show me the real thing
A few of the controls (paraphrased)
```
Mandatory     preventive  Protect the Log Archive from deletion       (SCP)
Region deny   preventive  Deny requests outside us-east-1             (SCP)
Recommended   detective   Detect S3 buckets that allow public read    (Config rule, you turn it on)
Elective      proactive   Check templates for unencrypted buckets     (CloudFormation hook)
```
Exam tipPreventive = organization policies such as SCPs, which stop it happening. Detective = AWS Config rules, which spot it afterwards. Proactive = CloudFormation hooks, which check before deploying.
You sign in at the access portal with MFA, pick Prod and get the AdministratorAccess role, with temporary credentials as always.
You try to launch an instance in eu-west-1. Region deny is an SCP, so the request is refused before anything gets created.
- 🧱SCP Region deny: eu-west-1 is not allowedDenied
Exam tipIf the question says "must never be possible", the answer is a preventive control.
In Dev, someone makes an S3 bucket public. A detective control can't stop that, but AWS Config sees the change and marks the bucket noncompliant.
- 🔍AWS Config s3-bucket-public-read-prohibited: NON_COMPLIANTFlagged
Exam tipIf the question says "find out when" or "report on", the answer is a detective control.
The finding is collected in the Audit account and appears on the Control Tower dashboard, so someone can fix it.
Show me the real thing
Control Tower dashboard (trimmed)
```
Noncompliant resources
  Dev (333333333333)  todoio-dev-uploads  Detect public read access to S3 buckets
```

What to notice

Control Tower builds what the manual Day 0 did by hand, and adds Log Archive and Audit accounts.
Logs live in their own account, away from the workloads that create them.
New accounts come out of Account Factory already set up. No more copying settings by hand.
Preventive controls (SCPs) block. Detective controls (Config rules) report. Proactive controls check before deploying.
Under the hood it is the same building blocks: Organizations, Identity Center, CloudTrail and Config.