AWS Control Tower Overview and Landing Zone Hands-On

Summary

This video tutorial introduces AWS Control Tower, an extension to AWS Organizations that simplifies governance across accounts and organizational units. It explains how to create a landing zone, a multi-account baseline based on AWS best practices. The video outlines the setup of guardrails for governance and compliance, including preventive and detective guardrails. It also demonstrates the setup process, including defining organizational units, configuring shared accounts, and managing guardrails, all within the Control Tower console.

Takeaways

• 🌐 **AWS Control Tower Overview**: Control Tower is an extension to AWS Organizations that provides additional control and governance over AWS resources.
• 🚀 **Landing Zone Creation**: With Control Tower, you can create a landing zone, which is a multi-account baseline based on AWS best practices.
• 🏢 **Organizational Structure**: Control Tower sets up a series of organizational units (OUs) and accounts, including Security, Sandbox, and Production OUs.
• 🔐 **Security and Auditing**: The Security OU contains Audit and Log Archive accounts for gathering auditing information and consolidating logs.
• 🔑 **Single Sign-On Integration**: Control Tower integrates with AWS Single Sign-On, allowing for centralized access management.
• 🛡️ **Guardrails for Governance**: Preventive guardrails are service control policies that disallow certain API actions, while detective guardrails monitor compliance using AWS Config rules and Lambda functions.
• 🌟 **Root User Exemption**: The root user in the management account can perform actions that guardrails would disallow, similar to AWS Organizations.
• 📝 **Setup Process**: The script outlines the step-by-step process of setting up a landing zone in Control Tower, including defining home regions and organizational unit structures.
• 🔄 **Account Factory**: Control Tower provides options for defining VPC configurations and enrolling or creating new accounts under its governance.
• 🔑 **Encryption Settings**: During setup, you can configure encryption settings for shared accounts like the log archive and audit accounts.
• 📊 **Compliance and Governance Tools**: Control Tower offers tools to view compliance, service control policies (SCPs), and non-compliant resources within each OU.

Q & A

What is AWS Control Tower?

AWS Control Tower is an extension to AWS Organizations that provides additional control and governance over your AWS resources. It creates a well-architected, multi-account baseline known as a landing zone, based on AWS best practices.

What is a landing zone in the context of AWS Control Tower?

A landing zone in AWS Control Tower is a well-architected, multi-account baseline that includes a predefined set of organizational units and accounts, designed according to AWS best practices.

What organizational units does Control Tower create by default?

By default, Control Tower creates the Security OU, the Sandbox OU, and the Production OU. The Security OU contains the Audit and Log Archive accounts.

What is the purpose of the Audit account in Control Tower?

The Audit account in Control Tower is used to gather auditing information provided by Control Tower, facilitating compliance and governance across the AWS environment.

How does AWS Control Tower integrate with Single Sign-On?

Control Tower integrates with Single Sign-On by allowing the use of AWS SSO directories, SAML 2.0 identity providers, or Microsoft Active Directory as directory sources for SSO.

What are preventive guardrails in AWS Control Tower?

Preventive guardrails in AWS Control Tower are service control policies that disallow certain API actions to enforce governance and compliance within the landing zone.

What are detective guardrails, and how do they differ from preventive guardrails?

Detective guardrails in AWS Control Tower are used for monitoring and governing compliance. They are based on AWS Lambda functions and AWS Config rules, unlike preventive guardrails which are based on service control policies.

How does the root user in the management account interact with guardrails in Control Tower?

The root user in the management account can perform actions that guardrails would disallow, similar to how SCPs in AWS Organizations do not affect the root user.

What is the process for setting up a landing zone using AWS Control Tower?

The process involves logging into your account, navigating to the Control Tower home page, clicking on 'Setup Landing Zone', defining your home region, configuring organizational units, setting up shared accounts and encryption settings, and finally confirming the setup.

How can existing accounts be brought under the control of AWS Control Tower?

Existing accounts can be enrolled in AWS Control Tower by providing their email addresses and other required information through the 'Enroll Accounts' option in the Control Tower console.

What is the Marketplace for Control Tower, and how does it relate to AWS Control Tower?

The Marketplace for Control Tower is a collection of solutions that can be used in conjunction with AWS Control Tower to enhance governance, compliance, and management of AWS resources.