AWS controltower documentation change
Summary
Removed detailed drift resolution procedures, simplified drift examples, and restructured content about governance drift. Removed specific resolution methods like 'Re-register OU' and API-based solutions.
Security assessment
The changes focus on documentation restructuring and content simplification rather than addressing security vulnerabilities. While drift detection relates to governance, the modifications don't introduce new security features or address specific security weaknesses. Removed content appears to be procedural rather than security-critical.
Diff
diff --git a/controltower/latest/userguide/drift.md b/controltower/latest/userguide/drift.md index 05dfad713..753f2378e 100644 --- a//controltower/latest/userguide/drift.md +++ b//controltower/latest/userguide/drift.md @@ -5 +5 @@ -Detecting driftResolving driftConsiderations about drift and SCP scansTypes of drift to resolve right awayRepairable changes to resourcesDrift and new account provisioning +Detecting driftConsiderations about drift and SCP scansTypes of drift to resolve right awayRepairable changes to resourcesDrift and new account provisioning @@ -29 +29 @@ If the same type of drift occurs on the same set of resources multiple times, AW -###### Examples: Account drift and SCP drift are handled in the following manner +###### Example: SCP drift is handled in the following manner @@ -35,2 +34,0 @@ If the same type of drift occurs on the same set of resources multiple times, AW - * If an account is moved between the same source and destination OUs multiple times, without repairing the drift first, a single notification is sent, even though the account moved between those OUs more than one time. - @@ -42 +40 @@ If the same type of drift occurs on the same set of resources multiple times, AW - * Account moved between OUs + * Account moved between OUs (see _[Inheritance drift on enabled baselines](./governance-drift.html#drift-enabled-baseline)_) @@ -53 +51 @@ When you move an account from one OU to another, the controls from the previous -###### Types of policy drift +###### Examples of policy drift @@ -68,24 +65,0 @@ For more information, see [Types of Governance Drift](https://docs.aws.amazon.co -## Resolving drift - -Although detection is automatic, the steps to resolve drift must be done manually through the console, or for controls, by calling the **ResetEnabledControl** API. - - * Many types of drift can be resolved through the **Landing zone settings** page. You can choose the **Reset** button in the **Versions** section to resolve these types of drift. - - * If your OU has fewer than 1000 accounts, you can resolve drift in Account Factory provisioned accounts, or SCP drift, by selecting **Re-register OU** on the **Organization** page or the **OU details** page. - - * You may be able to resolve account drift, such as [Moved member account](./governance-drift.html#drift-account-moved), by updating an individual account. For more information, see [Update the account in the console](./updating-account-factory-accounts.html#update-account-in-console). - - * For controls, many types of drift can be resolved by calling the **ResetEnabledControl** API. - - - - -###### When you take action to resolve drift on a landing zone version, two behaviors are possible. - - * If you are on the latest landing zone version, when you choose **Reset** and then choose **Confirm** , your drifted landing zone resources are reset to the saved AWS Control Tower configuration. The landing zone version stays the same. - - * If you are not on the latest version, you must choose **Update**. The landing zone is upgraded to the latest landing zone version. Drift is resolved as part of this process. - - - - @@ -186 +160 @@ Troubleshooting guide -Types of governance drift +Viewing drift