AWS controltower documentation change
Summary
Added documentation about auto-enrollment prerequisites, clarified requirements for AWSControlTowerExecution role, and expanded explanations of trusted access between CloudFormation and Organizations
Security assessment
The changes clarify security-related permissions (AWSControlTowerExecution role) and trusted access mechanisms between AWS services, but do not address a specific vulnerability. The documentation improvements explain existing security controls rather than patching a weakness.
Diff
diff --git a/controltower/latest/userguide/enrollment-prerequisites.md b/controltower/latest/userguide/enrollment-prerequisites.md index 1ffa24554..70373849c 100644 --- a//controltower/latest/userguide/enrollment-prerequisites.md +++ b//controltower/latest/userguide/enrollment-prerequisites.md @@ -6,0 +7,2 @@ + _This section describes how to enroll an existing AWS account into AWS Control Tower if you have not selected the optional auto-enroll feature on the landing zone**Settings** page, or if you are operating with a landing zone version previous to 3.1._ + @@ -8,0 +11,4 @@ These prerequisites are required before you can enroll an existing AWS account i +###### Note + +The prerequisite to add the `AWSControlTowerExecution` role is not required if you have activated the AWS Control Tower auto-enroll capability in the landing zone **Settings** page, or if you are enrolling the account as part of a **Register OU** process. However, in all cases, the account to be enrolled may not have existing AWS Config resources. See [Enroll accounts that have existing AWS Config resources](https://docs.aws.amazon.com/controltower/latest/userguide/existing-config-resources.html) + @@ -15 +21 @@ Role Permission: `AdministratorAccess` (AWS managed policy) -Role Trust Relationship: +**Role Trust Relationship:** @@ -49,0 +56,8 @@ When you enroll an account into AWS Control Tower, your account is governed by t +**About trusted access with the`AWSControTowerExecution` role** + +Before you can enroll an existing AWS account into AWS Control Tower you must give permission for AWS Control Tower to manage, or _govern_ , the account. Specifically, AWS Control Tower requires permission to establish trusted access between AWS CloudFormation and AWS Organizations on your behalf, so that AWS CloudFormation can deploy your stack automatically to the accounts in your selected organization. With this trusted access, the `AWSControlTowerExecution` role conducts activities required to manage each account. That's why you must add this role to each account before you enroll it. + +When trusted access is enabled, AWS CloudFormation can create, update, or delete stacks across multiple accounts and AWS Regions with a single operation. AWS Control Tower relies on this trust capability so it can apply roles and permissions to existing accounts before it moves them into a registered organizational unit, and thereby brings them under governance. + +To learn more about trusted access and AWS CloudFormation StackSets, see [AWS CloudFormationStackSets and AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/services-that-can-integrate-cloudformation.html). + @@ -56 +70 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Enroll an existing AWS account +About enrolling accounts @@ -58 +72 @@ Enroll an existing AWS account -Enroll an account +Auto-enrollment option