AWS controltower medium security documentation change
Summary
Added documentation for 'Inheritance drift on enabled baselines' detection and resolution, restructured drift type categorization, expanded explanations for control drift, and clarified unreported drift scenarios
Security assessment
The changes enhance documentation about detecting configuration drift in security controls (SCPs, baselines) and inherited policies. This helps users maintain security posture by identifying deviations from established governance policies. The addition of 'inheritance drift' detection specifically helps prevent security gaps from misconfigured resource baselines.
Diff
diff --git a/controltower/latest/userguide/governance-drift.md b/controltower/latest/userguide/governance-drift.md index 5dd413025..afa3af855 100644 --- a//controltower/latest/userguide/governance-drift.md +++ b//controltower/latest/userguide/governance-drift.md @@ -5 +5 @@ -Moved member accountRemoved member accountUnplanned update to managed SCPSCP attached to managed OUSCP detached from managed OUSCP attached to member accountDeleted Foundational OUSecurity Hub control driftControl policy driftTrusted access disabled +Moved member accountRemoved member accountUnplanned update to managed SCPSCP attached to managed OUSCP detached from managed OUSCP attached to member accountDeleted Foundational OUSecurity Hub control driftControl policy driftTrusted access disabledInheritance drift on enabled baselines @@ -9 +9,3 @@ Moved member accountRemoved member accountUnplanned update to managed SCPSCP att -Governance drift, also called _organizational drift_ occurs when OUs, SCPs, and member accounts are changed or updated. The types of governance drift that can be detected in AWS Control Tower are as follows: +Governance drift, also called _organizational drift_ occurs when OUs, SCPs, and member accounts are changed or updated. The types of governance drift that can be detected in AWS Control Tower are as follows: Account and OU governance drift, Landing zone drift, Control drift for non-SCP controls, Baseline drift. + +###### Account and OU governance drift @@ -25,0 +28,2 @@ Governance drift, also called _organizational drift_ occurs when OUs, SCPs, and +**Landing zone drift** + @@ -35 +39,3 @@ Another type of drift is _landing zone drift_ , which may be found through the m -A special case of landing zone drift is _role drift_ , which is detected when a required role is not available. If this type of drift occurs, the console displays a warning page and some instructions on how to restore the role. Your landing zone is unavailable until the role drift is resolved. For more information about drift, see _Don't delete required roles_ in the section called [Types of drift to resolve right away](./drift.html#types-of-drift). +A special case of landing zone drift is _role drift_ , which is detected when a required role is not available. If this type of drift occurs, the console displays a warning page and some instructions on how to restore the role. Your landing zone is unavailable until the role drift is resolved. For more information about role drift, see _Don't delete required roles_ in the section called [Types of drift to resolve right away](./drift.html#types-of-drift). + +**Control drift for non-SCP controls** @@ -37 +43 @@ A special case of landing zone drift is _role drift_ , which is detected when a -AWS Control Tower reports _control drift_ regarding controls implemented with resource control policies (RCPs), and controls that are part of the **AWS Security Hub Service-managed Standard: AWS Control Tower**. +AWS Control Tower reports _control drift_ regarding controls implemented with resource control policies (RCPs), declarative policies and controls that are part of the **AWS Security Hub Service-managed Standard: AWS Control Tower**. @@ -46 +52,17 @@ AWS Control Tower reports _control drift_ regarding controls implemented with re -AWS Control Tower does not look for drift regarding other services that work with the management account, including CloudTrail, CloudWatch, IAM Identity Center, AWS CloudFormation, AWS Config, and so forth. No drift detection is available in child accounts, because these accounts are protected by preventive mandatory controls. +**Enabled baseline drift** + +When baseline configurations on member accounts are different than those applied to the parent OU, AWS Control Tower reports inheritance drift for enabled baselines (resource configurations) on your OUs and accounts. For more information about baselines, see [Types of baselines](https://docs.aws.amazon.com/controltower/latest/userguide/types-of-baselines.html). + + * Inheritance drift on enabled baselines + + + + +###### Drift that is not reported + + * AWS Control Tower does not look for drift regarding other services that work with the management account, including AWS CloudTrail, Amazon CloudWatch, IAM Identity Center, AWS CloudFormation, AWS Config, and so forth. + + * AWS Control Tower does not detect resource drift or other kinds of drift that may happen if you modify the resources contained in a baseline. + + + @@ -348,0 +371,18 @@ AWS Control Tower notifies you when this type of drift occurs in the AWS Control +## Inheritance drift on enabled baselines + +This type of drift can occur to AWS Control Tower OUs and accounts. + +### Resolution + +AWS Control Tower notifies you when this type of drift occurs. For almost all cases of inheritance drift, you will receive an SNS notification for _Moved member account_ drift. That's because this type of drift typically occurs when an account has been moved, or an account fails enrollment. + +**View and resolve drift in the console** + +In the AWS Control Tower console, you can view the drift status in the **Baseline state** column on the **Organizations** page. The resolution from the console is to **Re-register** your OU or **Update** your account. + +**View and resolve drift programmatically** + +To view drift status programmatically, you can call the [`ListEnabledBaselines`](https://docs.aws.amazon.com/controltower/latest/APIReference/API_ListEnabledBaselines.html) API to view statuses for the enabled baselines on your OUs. To view statuses for individual accounts programmatically with the `ListEnabledBaselines` API, use the `includeChildren` flag. + +You can resolve this type of drift programmatically, by calling the [`ResetEnabledBaseline`](https://docs.aws.amazon.com/controltower/latest/APIReference/API_ResetEnabledBaseline.html) API. + @@ -355 +395 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Drift +Resolving drift