AWS controltower documentation change
Summary
Added documentation for two account enrollment methods (auto-enrollment and manual enrollment), updated section headers, and clarified prerequisites/process steps.
Security assessment
The changes document AWS Control Tower's auto-enrollment feature and enrollment prerequisites, which relate to security governance. However, there is no evidence of addressing a specific vulnerability or incident. The documentation improves clarity about security-related account management processes.
Diff
diff --git a/controltower/latest/userguide/quick-account-provisioning.md b/controltower/latest/userguide/quick-account-provisioning.md index 3f78612f2..47482713a 100644 --- a//controltower/latest/userguide/quick-account-provisioning.md +++ b//controltower/latest/userguide/quick-account-provisioning.md @@ -5 +5 @@ -Steps to enroll an accountCommon causes for failure of enrollment +Steps to enroll an account manuallyCommon causes for failure of enrollment @@ -8,0 +9,13 @@ Steps to enroll an accountCommon causes for failure of enrollment +Two common ways exist to enroll an account into AWS Control Tower. + + 1. After you select the _auto-enrollment_ feature in the **Settings** page, you can create an AWS account outside of AWS Control Tower and move it directly into a registered OU. For more information, see [Move and enroll accounts automatically](https://docs.aws.amazon.com/controltower/laters/ug/account-auto-enroll.html). + + 2. You can enroll an existing account from the AWS Control Tower console. + + + + +The following sections describe the second option, which requres no previous configuration of your AWS Control Tower environment. The AWS account must fulfill the required [prerequisites](https://docs.aws.amazon.com/controltower/latest/userguide/enrollment-prerequisites.html). + +**Enroll the account from the console** + @@ -11 +24,3 @@ The **Enroll account** feature is available in the AWS Control Tower console, fo -The **Enroll account** capability is available when your landing zone is not in a state of [drift](https://docs.aws.amazon.com/controltower/latest/userguide/drift.html). To view this capability in the console: +The **Enroll account** capability is available when your landing zone is not in a state of [drift](https://docs.aws.amazon.com/controltower/latest/userguide/drift.html). + +**To view your eligible accounts in the console:** @@ -17 +32 @@ The **Enroll account** capability is available when your landing zone is not in - * Follow the steps for enrolling an individual account, as shown in the Steps to enroll an account section. + * Follow the steps for enrolling an individual account, as shown in the Steps to enroll an account manually section. @@ -30 +45 @@ When you enroll accounts from the AWS Control Tower console, you must be signed -Accounts that you enroll may be updated by means of AWS Service Catalog and the AWS Control Tower account factory, as you would update any other account. Update procedures are given in the section called [Update and move account factory accounts with AWS Control Tower or with AWS Service Catalog](./updating-account-factory-accounts.html). +Accounts that you enroll may be updated by means of the AWS Control Tower account factory, as you would update any other account. Update procedures are given in the section called [Update and move account factory accounts with AWS Control Tower or with AWS Service Catalog](./updating-account-factory-accounts.html). @@ -32 +47 @@ Accounts that you enroll may be updated by means of AWS Service Catalog and the -## Steps to enroll an account +## Steps to enroll an account manually @@ -36 +51 @@ After the **AdministratorAccess** permission (policy) is in place in your existi -###### To enroll an individual account in AWS Control Tower +###### To enroll an individual account in AWS Control Tower from the console