AWS controltower documentation change
Summary
Updated account enrollment workflow description, changed 'Easier enroll and update' to 'Simplified account creation and enrollment', removed manual role requirement, and streamlined process details.
Security assessment
The removal of the explicit requirement for the AWSControlTowerExecution role could impact security posture, but there is no evidence this change addresses a vulnerability. The update appears focused on usability improvements rather than security documentation. No new security features or vulnerabilities are explicitly mentioned.
Diff
diff --git a/controltower/latest/userguide/2022-all.md b/controltower/latest/userguide/2022-all.md index 909e54644..41a9d7eda 100644 --- a//controltower/latest/userguide/2022-all.md +++ b//controltower/latest/userguide/2022-all.md @@ -5 +5 @@ -Concurrent account operationsAccount Factory Customization (AFC)Comprehensive controls assist in AWS resource provisioning and managementCompliance status viewable for all AWS Config rulesAPI for controls and a new AWS CloudFormation resourceCfCT supports stack set deletionCustomized log retentionRole drift repair availableAWS Control Tower landing zone version 3.0The Organization page combines views of OUs and accountsEasier enroll and update for individual member accountsAFT supports automated customization for shared AWS Control Tower accountsConcurrent operations for all optional controlsExisting security and logging accountsAWS Control Tower landing zone version 2.9AWS Control Tower landing zone version 2.8 +Concurrent account operationsAccount Factory Customization (AFC)Comprehensive controls assist in AWS resource provisioning and managementCompliance status viewable for all AWS Config rulesAPI for controls and a new AWS CloudFormation resourceCfCT supports stack set deletionCustomized log retentionRole drift repair availableAWS Control Tower landing zone version 3.0The Organization page combines views of OUs and accountsSimplified account creation and enrollmentAFT supports automated customization for shared AWS Control Tower accountsConcurrent operations for all optional controlsExisting security and logging accountsAWS Control Tower landing zone version 2.9AWS Control Tower landing zone version 2.8 @@ -31 +31 @@ In 2022, AWS Control Tower released the following updates: - * Easier enroll and update for individual member accounts + * Simplified account creation and enrollment @@ -139 +139 @@ If you choose not customize your log retention, the default settings are 1 year -This feature is available for existing customers through AWS Control Tower when you update or repair your landing zone, and for new customers through the AWS Control Tower setup process. +This feature is available for existing customers through AWS Control Tower when you update or repair your landing zone, and for new customers through the AWS Control Tower setup @@ -266 +266 @@ This video (3:07) describes how to update your existing AWS Control Tower landin -The new **Organization** page in AWS Control Tower shows a hierarchical view of all organizational units (OUs) and accounts. It combines the information from the **OUs** and **Accounts** pages, which existed previously. +The new **Organization** page in AWS Control Tower shows a hierarchical (tree) view of all organizational units (OUs) and accounts. It combines the information from the **OUs** and **Accounts** pages, which existed previously. @@ -270 +270 @@ On the new page, you can see relationships between parent OUs and their nested O -## Easier enroll and update for individual member accounts +## Simplified account creation and enrollment @@ -272 +272 @@ On the new page, you can see relationships between parent OUs and their nested O -**May 31, 2022** +**June 30, 2022** @@ -274,7 +274 @@ On the new page, you can see relationships between parent OUs and their nested O -(No update required for AWS Control Tower landing zone) - -AWS Control Tower now gives you an improved capability to update and enroll member accounts individually. Each account shows when it is available for an update, so you can more easily ensure that your member accounts include the latest configuration. You can update your landing zone, remediate account drift, or enroll an account into a registered OU, in a few streamlined steps. - -When you update an account, there’s no need to include an account’s entire organizational unit (OU) in each update action. As a result, the time required to update an individual account is greatly reduced. - -You can enroll accounts into AWS Control Tower OUs with more help from the AWS Control Tower console. Existing accounts that you enroll in AWS Control Tower must still meet the account prerequisites, and you must add the `AWSControlTowerExecution` role. Then, you can choose any registered OU and enroll the account into it by selecting the **Enroll** button. +(No update required for AWS Control Tower landing zone.) @@ -282 +276 @@ You can enroll accounts into AWS Control Tower OUs with more help from the AWS C -We’ve separated the **Enroll account** functionality from the **Create** account workflow in account factory, to create more distinction between these similar processes, and help avoid setup errors when you’re entering account information. +AWS Control Tower now provides a simplified workflow for creating and enrolling accounts. You can create a new account or enroll an existing account in a single workflow, without navigating to the Service Catalog console. For more information, see [Enroll an existing account](./quick-account-provisioning.html).