AWS controltower documentation change
Summary
Added note clarifying that AWS Control Tower removes AWSControlTowerExecution role during account unenrollment
Security assessment
Clarifies role management behavior but does not address security vulnerabilities or introduce new security features.
Diff
diff --git a/controltower/latest/userguide/awscontroltowerexecution.md b/controltower/latest/userguide/awscontroltowerexecution.md index abf2f6023..227a09b71 100644 --- a//controltower/latest/userguide/awscontroltowerexecution.md +++ b//controltower/latest/userguide/awscontroltowerexecution.md @@ -21,0 +22,4 @@ The `AWSControlTowerExecution` role can be added into an account in several ways +###### Note + +When you unenroll an account, AWS Control Tower removes the `AWSControlTowerExecution` role, no matter if it was created manually or by AWS Control Tower itself. +