AWS controltower documentation change
Summary
Updated documentation for AWS Control Tower 2023 features including new APIs (landing zone, control tagging), region availability expansions, transition to AWS Service Catalog External product type, addition of 28+ proactive controls, trusted access drift detection, and general availability of proactive controls. Removed detailed Security Hub control lists and consolidated content.
Security assessment
Changes focus on documenting security enhancements like proactive controls, drift detection, and IAM Identity Center improvements rather than addressing vulnerabilities. The removal of specific Security Hub control details appears to be documentation consolidation rather than deprecation of security functionality. New APIs like UpdateEnabledControl and trusted access drift monitoring directly support security posture management.
Diff
diff --git a/controltower/latest/userguide/2023-all.md b/controltower/latest/userguide/2023-all.md index 55039562d..b05f6443c 100644 --- a//controltower/latest/userguide/2023-all.md +++ b//controltower/latest/userguide/2023-all.md @@ -5 +5 @@ -Transition to new AWS Service Catalog External product type (phase 3)AWS Control Tower landing zone version 3.3Transition to new AWS Service Catalog External product type (phase 2)AWS Control Tower announces controls to assist digital sovereigntyAWS Control Tower supports landing zone APIsAWS Control Tower supports tagging for enabled controlsAWS Control Tower available in Asia Pacific (Melbourne) RegionTransition to new AWS Service Catalog External product type (phase 1)New control API availableAWS Control Tower adds additional controlsNew drift type reported: trusted access disabledFour additional AWS RegionsAWS Control Tower available in Tel Aviv RegionAWS Control Tower launches 28 new proactive controlsAWS Control Tower deprecates two controlsAWS Control Tower landing zone version 3.2AWS Control Tower handles accounts based on IDAdditional Security Hub detective controls available in the AWS Control Tower controls libraryAWS Control Tower publishes control metadata tablesTerraform support for Account Factory CustomizationAWS IAM Identity Center self-management available for landing zoneAWS Control Tower addresses mixed governance for OUsAdditional proactive controls availableUpdated Amazon EC2 proactive controlsSeven additional AWS Regions available Account Factory for Terraform (AFT) account customization request tracing AWS Control Tower landing zone version 3.1Proactive controls generally available +Transition to new AWS Service Catalog External product type (phase 3)AWS Control Tower landing zone version 3.3Transition to new AWS Service Catalog External product type (phase 2)AWS Control Tower announces controls to assist digital sovereigntyAWS Control Tower landing zone APIsAWS Control Tower control tagging APIsAWS Control Tower available in AWS Asia Pacific (Melbourne)Transition to new AWS Service Catalog External product type (phase 1)AWS Control Tower adds new control APIAWS Control Tower adds new controlsAWS Control Tower detects trusted access driftAWS Control Tower available in four additional AWS RegionsAWS Control Tower available in AWS Israel (Tel Aviv)AWS Control Tower adds 28 new proactive controlsAWS Control Tower deprecates two controlsAWS Control Tower landing zone version 3.2AWS Control Tower adds email-to-ID mapping for IAM Identity CenterAWS Control Tower adds more AWS Security Hub controlsAWS Control Tower publishes metadata for AWS Security Hub controlsAWS Control Tower adds Account Factory Customization (AFC) for TerraformAWS Control Tower adds self-managed IAM identity centerAWS Control Tower adds mixed governance noteAWS Control Tower adds new proactive controlsAWS Control Tower updates Amazon EC2 controlsAWS Control Tower available in seven additional AWS RegionsAWS Control Tower Account Factory Customization (AFC) and request tracing generally availableAWS Control Tower landing zone version 3.1AWS Control Tower proactive controls generally available @@ -19 +19 @@ In 2023, AWS Control Tower released the following updates: - * AWS Control Tower supports landing zone APIs + * AWS Control Tower landing zone APIs @@ -21 +21 @@ In 2023, AWS Control Tower released the following updates: - * AWS Control Tower supports tagging for enabled controls + * AWS Control Tower control tagging APIs @@ -23 +23 @@ In 2023, AWS Control Tower released the following updates: - * AWS Control Tower available in Asia Pacific (Melbourne) Region + * AWS Control Tower available in AWS Asia Pacific (Melbourne) @@ -27 +27 @@ In 2023, AWS Control Tower released the following updates: - * New control API available + * AWS Control Tower adds new control API @@ -29 +29 @@ In 2023, AWS Control Tower released the following updates: - * AWS Control Tower adds additional controls + * AWS Control Tower adds new controls @@ -31 +31 @@ In 2023, AWS Control Tower released the following updates: - * New drift type reported: trusted access disabled + * AWS Control Tower detects trusted access drift @@ -33 +33 @@ In 2023, AWS Control Tower released the following updates: - * Four additional AWS Regions + * AWS Control Tower available in four additional AWS Regions @@ -35 +35 @@ In 2023, AWS Control Tower released the following updates: - * AWS Control Tower available in Tel Aviv Region + * AWS Control Tower available in AWS Israel (Tel Aviv) @@ -37 +37 @@ In 2023, AWS Control Tower released the following updates: - * AWS Control Tower launches 28 new proactive controls + * AWS Control Tower adds 28 new proactive controls @@ -43 +43 @@ In 2023, AWS Control Tower released the following updates: - * AWS Control Tower handles accounts based on ID + * AWS Control Tower adds email-to-ID mapping for IAM Identity Center @@ -45 +45 @@ In 2023, AWS Control Tower released the following updates: - * Additional Security Hub detective controls available in the AWS Control Tower controls library + * AWS Control Tower adds more AWS Security Hub controls @@ -47 +47 @@ In 2023, AWS Control Tower released the following updates: - * AWS Control Tower publishes control metadata tables + * AWS Control Tower publishes metadata for AWS Security Hub controls @@ -49 +49 @@ In 2023, AWS Control Tower released the following updates: - * Terraform support for Account Factory Customization + * AWS Control Tower adds Account Factory Customization (AFC) for Terraform @@ -51 +51 @@ In 2023, AWS Control Tower released the following updates: - * AWS IAM Identity Center self-management available for landing zone + * AWS Control Tower adds self-managed IAM identity center @@ -53 +53 @@ In 2023, AWS Control Tower released the following updates: - * AWS Control Tower addresses mixed governance for OUs + * AWS Control Tower adds mixed governance note @@ -55 +55 @@ In 2023, AWS Control Tower released the following updates: - * Additional proactive controls available + * AWS Control Tower adds new proactive controls @@ -57 +57 @@ In 2023, AWS Control Tower released the following updates: - * Updated Amazon EC2 proactive controls + * AWS Control Tower updates Amazon EC2 controls @@ -59 +59 @@ In 2023, AWS Control Tower released the following updates: - * Seven additional AWS Regions available + * AWS Control Tower available in seven additional AWS Regions @@ -61 +61 @@ In 2023, AWS Control Tower released the following updates: - * Account Factory for Terraform (AFT) account customization request tracing + * AWS Control Tower Account Factory Customization (AFC) and request tracing generally available @@ -65 +65 @@ In 2023, AWS Control Tower released the following updates: - * Proactive controls generally available + * AWS Control Tower proactive controls generally available @@ -230 +229,0 @@ As a new tool to the new Region deny enhancement, this release includes a new AP - * **CT.MULTISERVICE.PV.1** : Deny access to AWS based on the requested AWS Region for an organizational unit @@ -234,76 +233 @@ As a new tool to the new Region deny enhancement, this release includes a new AP - -The new detecive controls that enhance your digital sovereignty governance posture are part of the AWS Security Hub Service-Managed Standard AWS Control Tower. - -###### New detective controls - - * SH.ACM.2: RSA certificates managed by ACM should use a key length of at least 2,048 bits - - * SH.AppSync.5: AWS AppSync GraphQL APIs should not be authenticated with API keys - - * SH.CloudTrail.6: Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible : - - * SH.DMS.9: DMS endpoints should use SSL - - * SH.DocumentDB.3: Amazon DocumentDB manual cluster snapshots should not be public - - * SH.DynamoDB.3: DynamoDB Accelerator (DAX) clusters should be encrypted at rest - - * SH.EC2.23: EC2 Transit Gateways should not automatically accept VPC attachment requests - - * SH.EKS.1: EKS cluster endpoints should not be publicly accessible - - * SH.ElastiCache.3: ElastiCache replication groups should have automatic failover enabled - - * SH.ElastiCache.4: ElastiCache replication groups should have encryption-at-rest enabled - - * SH.ElastiCache.5: ElastiCache replication groups should have encryption-in-transit enabled - - * SH.ElastiCache.6: ElastiCache replication groups of earlier Redis versions should have Redis AUTH enabled - - * SH.EventBridge.3: EventBridge custom event buses should have a resource-based policy attached - - * SH.KMS.4: AWS KMS key rotation should be enabled - - * SH.Lambda.3: Lambda functions should be in a VPC - - * SH.MQ.5: ActiveMQ brokers should use active/standby deployment mode - - * SH.MQ.6: RabbitMQ brokers should use cluster deployment mode - - * SH.MSK.1: MSK clusters should be encrypted in transit among broker nodes - - * SH.RDS.12: IAM authentication should be configured for RDS clusters - - * SH.RDS.15: RDS DB clusters should be configured for multiple Availability Zones - - * SH.S3.17: S3 buckets should be encrypted at rest with AWS KMS keys - - - - -For more information about controls added to the AWS Security Hub Service-Managed Standard AWS Control Tower see [Controls that apply to Service-Managed Standard: AWS Control Tower](https://docs.aws.amazon.com/securityhub/latest/userguide/service-managed-standard-aws-control-tower.html#aws-control-tower-standard-controls) in the AWS Security Hub documentation. - -For a list of AWS Regions that do not support certain controls that are part of the AWS Security Hub Service-Managed Standard AWS Control Tower, see [Unsupported Regions](https://docs.aws.amazon.com/controltower/latest/controlreference/security-hub-controls.html#sh-unsupported-regions). - -**New configurable control for Region deny at the OU level** - -**CT.MULTISERVICE.PV.1** : This control accepts parameters to specify exempted Regions, IAM principals, and Actions that are allowed, at the OU level, rather than for the entire AWS Control Tower landing zone. It is a preventive control, implemented by Service control policy (SCP). - -For more information, see [Region deny control applied to the OU](https://docs.aws.amazon.com/controltower/latest/controlreference/ou-region-deny.html). - -**The`UpdateEnabledControl` API** - -This AWS Control Tower release adds the following API support for controls: - - * The updated `EnableControl` API can configure controls that are configurable. - - * The updated `GetEnabledControl` API shows the configured parameters on an enabled control. - - * The new `UpdateEnabledControl` API can change parameters on an enabled control. - - - - -For more information, see the AWS Control Tower [API Reference](https://docs.aws.amazon.com/controltower/latest/APIReference/API_Operations.html). - -## AWS Control Tower supports landing zone APIs +## AWS Control Tower landing zone APIs @@ -315,17 +239 @@ For more information, see the AWS Control Tower [API Reference](https://docs.aws -AWS Control Tower now supports landing zone configuration and launch using APIs. You can create, update, get, list, reset, and delete landing zones using APIs. - -The following APIs enable you to set up and manage your landing zone programatically using AWS CloudFormation or the AWS CLI. - -AWS Control Tower supports the following APIs for landing zones: - - * `CreateLandingZone`–This API call creates a landing zone using a landing zone version and manifest file. - - * `GetLandingZoneOperation`–This API call returns the status of a specified landing zone operation. - - * `GetLandingZone`–This API call returns details about the specified landing zone, including the version, manifest file, and status. - - * `UpdateLandingZone`–This API call updates the landing zone version or manifest file. - - * `ListLandingZone`–This API call returns one landing zone identifier (ARN) for a landing zone setup in the management account. - - * `ResetLandingZone`–This API call resets the landing zone to the parameters specified at the latest update, which can repair drift. If the landing zone has not been updated, this call resets the landing zone to the parameters specified at creation. +AWS Control Tower now offers APIs that help you manage your landing zone programmatically. These APIs allow you to create, update, and reset your landing zone, as well as retrieve information about your landing zone configuration and operations. For more information, see [Landing zone API examples](https://docs.aws.amazon.com/controltower/latest/userguide/lz-api-examples-short.html). @@ -333 +241 @@ AWS Control Tower supports the following APIs for landing zones: - * `DeleteLandingZone`–This API call decommissions the landing zone. +The landing zone APIs are available in all AWS Regions where AWS Control Tower is available, except GovCloud (US) Regions. For a list of AWS Regions where AWS Control Tower is available, see the [AWS Region Table](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/). @@ -335,6 +243 @@ AWS Control Tower supports the following APIs for landing zones: - - - -To get started with landing zone APIs, see the [Get started with AWS Control Tower using APIs](./getting-started-apis.html). - -## AWS Control Tower supports tagging for enabled controls +## AWS Control Tower control tagging APIs @@ -346,12 +249 @@ To get started with landing zone APIs, see the [Get started with AWS Control Tow -AWS Control Tower now supports resource tagging for enabled controls, from the AWS Control Tower console or by means of APIs. You can add, remove, or list tags for enabled controls. - -With the release of the following APIs, you can configure tags for the controls you enable in AWS Control Tower. Tags help you manage, identify, organize, search for, and filter resources. You can create tags to categorize resources by purpose, owner, environment, or other criteria. - -AWS Control Tower supports the following APIs for control tagging: - - * `TagResource`–This API call adds tags to controls enabled in AWS Control Tower. - - * `UntagResource`–This API call removes tags from controls enabled in AWS Control Tower. - - * `ListTagsForResource`–This API call returns tags for controls enabled in AWS Control Tower. - +AWS Control Tower now offers APIs that help you tag your enabled controls programmatically. These APIs allow you to add, remove, and list tags for your enabled controls. For more information, see [Tagging AWS Control Tower resources](https://docs.aws.amazon.com/controltower/latest/userguide/tagging-resources.html). @@ -358,0 +251 @@ AWS Control Tower supports the following APIs for control tagging: +The control tagging APIs are available in all AWS Regions where AWS Control Tower is available, except GovCloud (US) Regions. For a list of AWS Regions where AWS Control Tower is available, see the [AWS Region Table](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/). @@ -360,4 +253 @@ AWS Control Tower supports the following APIs for control tagging: - -AWS Control Tower control APIs are available in AWS Regions where AWS Control Tower is available. For a full list of AWS Regions in which AWS Control Tower is available, see the [AWS Region Table](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/). For a full list of AWS Control Tower APIs, see the [API Reference](https://docs.aws.amazon.com/controltower/latest/APIReference/API_Operations.html). - -## AWS Control Tower available in Asia Pacific (Melbourne) Region +## AWS Control Tower available in AWS Asia Pacific (Melbourne) @@ -369,5 +259 @@ AWS Control Tower control APIs are available in AWS Regions where AWS Control To