AWS prescriptive-guidance medium security documentation change

Service: prescriptive-guidance · 2025-06-13 · Security-related medium

File: prescriptive-guidance/latest/patterns/deploy-and-manage-aws-control-tower-controls-by-using-aws-cdk-and-aws-cloudformation.md

Summary

Removed SCP requirement and updated control example to AWS-GR_DISALLOW_CROSS_REGION_NETWORKING with parameters

Security assessment

Added documentation for a network security control (AWS-GR_DISALLOW_CROSS_REGION_NETWORKING) that restricts cross-region networking, reducing attack surface. Parameters show how to exempt principals, directly impacting security configurations. Removal of SCP requirement could weaken security posture if not properly addressed elsewhere.

Diff

diff --git a/prescriptive-guidance/latest/patterns/deploy-and-manage-aws-control-tower-controls-by-using-aws-cdk-and-aws-cloudformation.md b/prescriptive-guidance/latest/patterns/deploy-and-manage-aws-control-tower-controls-by-using-aws-cdk-and-aws-cloudformation.md
index 213b48e0c..5210413d6 100644
--- a//prescriptive-guidance/latest/patterns/deploy-and-manage-aws-control-tower-controls-by-using-aws-cdk-and-aws-cloudformation.md
+++ b//prescriptive-guidance/latest/patterns/deploy-and-manage-aws-control-tower-controls-by-using-aws-cdk-and-aws-cloudformation.md
@@ -45,2 +44,0 @@ This pattern is recommended for users who have experience with AWS Control Tower
-  * Apply the service control policy (SCP)-based control with the identifier **CT.CLOUDFORMATION.PR.1**. This SCP must be activated to deploy proactive controls. For instructions, see [Disallow management of resource types, modules, and hooks within the AWS CloudFormation registry](https://docs.aws.amazon.com/controltower/latest/userguide/elective-controls.html#disallow-cfn-extensions).
-
@@ -260 +258 @@ Deploy the stack.| Enter the following commands to synthesize and deploy the Clo
-The following is an example of an updated **constants.py** file. This sample enables the **AWS-GR_ENCRYPTED_VOLUMES** control (global ID: `503uicglhjkokaajywfpt6ros`) and the **AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED** control (global ID: `50z1ot237wl8u1lv5ufau6qqo`). For a list of global IDs, see [All global identifiers](https://docs.aws.amazon.com/controltower/latest/controlreference/all-global-identifiers.html) in the AWS Control Tower documentation.
+The following is an example of an updated **constants.py** file. This sample enables the **AWS-GR_DISALLOW_CROSS_REGION_NETWORKING** control (global ID: `dvuaav61i5cnfazfelmvn9m6k`) and the **AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED** control (global ID: `50z1ot237wl8u1lv5ufau6qqo`). For a list of global IDs, see [All global identifiers](https://docs.aws.amazon.com/controltower/latest/controlreference/all-global-identifiers.html) in the AWS Control Tower documentation.
@@ -269 +267,6 @@ The following is an example of an updated **constants.py** file. This sample ena
-                "503uicglhjkokaajywfpt6ros",
+                "dvuaav61i5cnfazfelmvn9m6k": {  # AWS-GR_DISALLOW_CROSS_REGION_NETWORKING
+                    "Parameters": {
+                        "ExemptedPrincipalArns": ["arn:aws:iam::111122223333:role/RoleName"]
+                    },
+                    "Tags": [{"key": "Environment", "value": "Production"}]
+                },
@@ -276 +279 @@ The following is an example of an updated **constants.py** file. This sample ena
-                "50z1ot237wl8u1lv5ufau6qqo",
+                "50z1ot237wl8u1lv5ufau6qqo",  # AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED