AWS controltower documentation change
Summary
Added documentation for Account Factory for Terraform (AFT) configurations, account-level reporting APIs for baseline compliance, and IPv6 support in Control Catalog.
Security assessment
The addition of account-level reporting for drift detection and enrollment status via APIs enhances compliance monitoring capabilities, which indirectly supports security posture management. However, there is no explicit mention of addressing a security vulnerability. The IPv6 support update is a feature enhancement without direct security implications.
Diff
diff --git a/controltower/latest/userguide/2025-all.md b/controltower/latest/userguide/2025-all.md index 0e7cf9d40..405ebf309 100644 --- a//controltower/latest/userguide/2025-all.md +++ b//controltower/latest/userguide/2025-all.md @@ -5 +5 @@ -AWS Control Tower available in AWS Asia Pacific (Thailand) and Mexico (Central) RegionsAdditional AWS Config controls availableDeregister and delete actions for OUsAWS Control Tower supports IPv6 addresses +Account Factory for Terraform (AFT) supports new configurations at deploymentAWS Control Tower introduces account-level reporting for baseline APIsAWS Control Tower available in AWS Asia Pacific (Thailand) and Mexico (Central) RegionsAdditional AWS Config controls availableDeregister and delete actions for OUsControl Catalog supports IPv6 addresses @@ -10,0 +11,4 @@ Since January 2025, AWS Control Tower has released the following updates: + * Account Factory for Terraform (AFT) supports new configurations at deployment + + * AWS Control Tower introduces account-level reporting for baseline APIs + @@ -17 +21,20 @@ Since January 2025, AWS Control Tower has released the following updates: - * AWS Control Tower supports IPv6 addresses + * Control Catalog supports IPv6 addresses + + + + +## Account Factory for Terraform (AFT) supports new configurations at deployment + +**May 13, 2025** + +(No update required for AWS Control Tower landing zone.) + +The AWS Control Tower account customization framework, Account Factory for Terraform (AFT), now supports three additional optional configurations at the time of deployment. You can deploy AFT into a custom virtual private cloud (VPC), specify the Terraform project name for your AFT deployment, and tag the resources that AFT creates. + +For more information, see [Deploy AWS Control Tower Account Factory for Terraform (AFT)](https://docs.aws.amazon.com/controltower/latest/userguide/aft-getting-started.html). + +## AWS Control Tower introduces account-level reporting for baseline APIs + +**May 12, 2025** + +(No update required for AWS Control Tower landing zone.) @@ -18,0 +42 @@ Since January 2025, AWS Control Tower has released the following updates: +You can now view _drift_ and _account enrollment_ statuses programmatically for your governed accounts, by calling the baseline APIs. With this capability, you can identify when account and OU baseline configurations are _drifted_ , or out of sync. To view the drift status programmatically, you can call the [`ListEnabledBaselines`](https://docs.aws.amazon.com/controltower/latest/APIReference/API_ListEnabledBaselines.html) API for your enabled baselines. To view statuses for individual accounts programmatically with the `ListEnabledBaselines` API, use the `includeChildren` flag. You can filter by these statuses, and see only the accounts and OUs that require your attention. @@ -19,0 +44 @@ Since January 2025, AWS Control Tower has released the following updates: +The [`AWSControlTowerBaseline`](https://docs.aws.amazon.com/controltower/latest/userguide/types-of-baselines.html#ou-baseline-types) sets up best practice configurations, controls, and resources that are required for governance. When you enable this baseline on an organizational unit (OU), member accounts within the OU are enrolled into AWS Control Tower automatically. The AWS Control Tower baseline APIs include AWS CloudFormation support, which allows you to build automations that manage your OUs and accounts with infrastructure as code (IaC). @@ -20,0 +46 @@ Since January 2025, AWS Control Tower has released the following updates: +To learn more about these APIs, review [Baselines](https://docs.aws.amazon.com/controltower/latest/userguide/types-of-baselines.html) in the _AWS Control Tower User Guide_. The baseline APIs and newly launched reporting capabilities for _drift_ and _account enrollment_ status are available in all AWS Regions where AWS Control Tower is available. For a list of AWS Regions where AWS Control Tower is available, see the [AWS Region Table](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/). @@ -65 +91 @@ For more information, see [Remove an OU](./remove-ou.html). -## AWS Control Tower supports IPv6 addresses +## Control Catalog supports IPv6 addresses @@ -71 +97 @@ For more information, see [Remove an OU](./remove-ou.html). -The AWS Control Tower API now supports Internet Protocol version 6 (IPv6) addresses through our new dual-stack endpoints. The existing Control Catalog endpoints supporting IPv4 remains available for backwards compatibility. The new dual-stack domains are available either [from the internet](https://docs.aws.amazon.com/general/latest/gr/controlcatalog.html) or [from within an Amazon Virtual Private Cloud (VPC)](https://docs.aws.amazon.com/controlcatalog/latest/userguide/vpc-interface-endpoints.html) using [AWS PrivateLink](https://aws.amazon.com/privatelink/) _._ +The AWS Control Tower Control Catalog API now supports Internet Protocol version 6 (IPv6) addresses through our new dual-stack endpoints. The existing Control Catalog endpoints supporting IPv4 remains available for backwards compatibility. The new dual-stack domains are available either [from the internet](https://docs.aws.amazon.com/general/latest/gr/controlcatalog.html) or [from within an Amazon Virtual Private Cloud (VPC)](https://docs.aws.amazon.com/controlcatalog/latest/userguide/vpc-interface-endpoints.html) using [AWS PrivateLink](https://aws.amazon.com/privatelink/) _._