AWS controltower medium security documentation change
Summary
Removed section 'Exception to controls for the Security OU' that previously prohibited controls in Security OU.
Security assessment
Removing restrictions on deploying controls to Security OU could impact security posture by allowing stricter governance.
Diff
diff --git a/controltower/latest/controlreference/controls.md b/controltower/latest/controlreference/controls.md index 9c2e83573..80db6c849 100644 --- a//controltower/latest/controlreference/controls.md +++ b//controltower/latest/controlreference/controls.md @@ -5 +5 @@ -Exception to controls for the management accountException to controls for the Security OU +Exception to controls for the management account @@ -25,4 +24,0 @@ The root user and any administrators in the management account can perform work -## Exception to controls for the Security OU - -You cannot deploy proactive controls or Security Hub controls to the AWS Control Tower Security OU. AWS Control Tower deploys and manages resources in this OU, which are required so that AWS Control Tower can function properly. You can deploy preventive controls (SCP-based) and detective controls (based on AWS Config rules) to this OU. -