AWS controltower documentation change
Summary
Added documentation for 'Inheritance drift on enabled controls', restructured drift types into bullet points, expanded explanations of baseline/control inheritance drift, added new section for resolving control inheritance drift, and updated links/terminology.
Security assessment
The changes enhance documentation about governance drift detection (including controls inheritance drift) and remediation steps. While drift detection helps maintain security posture by identifying configuration deviations, there is no evidence of addressing a specific vulnerability. The updates improve clarity about existing security-related features (drift monitoring/resolution).
Diff
diff --git a/controltower/latest/userguide/governance-drift.md b/controltower/latest/userguide/governance-drift.md index 5ac7327a1..36e59f7e7 100644 --- a//controltower/latest/userguide/governance-drift.md +++ b//controltower/latest/userguide/governance-drift.md @@ -5 +5 @@ -Moved member accountRemoved member accountUnplanned update to managed SCPSCP detached from managed OUDeleted Foundational OUSecurity Hub control driftControl policy driftTrusted access disabledInheritance drift on enabled baselines +Moved member accountRemoved member accountUnplanned update to managed SCPSCP detached from managed OUDeleted Foundational OUSecurity Hub control driftControl policy driftTrusted access disabledInheritance drift on enabled baselinesInheritance drift on enabled controls @@ -9 +9,14 @@ Moved member accountRemoved member accountUnplanned update to managed SCPSCP det -Governance drift, also called _organizational drift_ occurs when OUs, SCPs, and member accounts are changed or updated. The types of governance drift that can be detected in AWS Control Tower are as follows: Account and OU governance drift, Landing zone drift, Control drift for non-SCP controls, Baseline drift. +Governance drift, also called _organizational drift_ occurs when OUs, SCPs, and member accounts are changed or updated. The types of governance drift that can be detected in AWS Control Tower are as follows: + + * Account and OU governance drift + + * Landing zone drift + + * Control drift for non-SCP controls + + * Inheritance drift for baselines and controls + + + + +The next sections provide detail about these types of drift that AWS Control Tower reports, and how to resolve them. @@ -48 +61,3 @@ AWS Control Tower reports _control drift_ regarding controls implemented with re -**Enabled baseline drift** +**Inheritance drift for baselines and controls** + + * **Enabled baseline drift** @@ -50 +65 @@ AWS Control Tower reports _control drift_ regarding controls implemented with re -When baseline configurations on member accounts are different than those applied to the parent OU, AWS Control Tower reports inheritance drift for enabled baselines (resource configurations) on your OUs and accounts. For more information about baselines, see [Types of baselines](https://docs.aws.amazon.com/controltower/latest/userguide/types-of-baselines.html). +When baseline configurations on a member account are different than those applied to the parent OU, AWS Control Tower reports inheritance drift for enabled baselines (resource configurations) on those OUs and accounts. For more information about baselines, see [Types of baselines](https://docs.aws.amazon.com/controltower/latest/userguide/types-of-baselines.html). @@ -53,0 +69,6 @@ When baseline configurations on member accounts are different than those applied + * **Enabled control drift** + +When enabled control configurations on a member account are different than those applied to the parent OU, AWS Control Tower reports inheritance drift for enabled controls on those OUs and accounts. + + * Inheritance drift on enabled controls + @@ -68 +89,3 @@ When baseline configurations on member accounts are different than those applied -This type of drift occurs on the account rather than the OU. This type of drift can occur when an AWS Control Tower member account, the audit account, or the log archive account is moved from a registered AWS Control Tower OU to any other OU. The following is an example of the Amazon SNS notification when this type of drift is detected. +This type of drift occurs on the account rather than the OU. This type of drift can occur when an AWS Control Tower member account, the audit account, or the log archive account is moved from a registered AWS Control Tower OU to any other OU. In many cases, you can avoid this type of drift if you activate the auto-enrollment feature for accounts, on the **Settings** page. For more details, see [Move and enroll accounts with auto-enrollment](./account-auto-enrollment.html). + +The following is an example of the Amazon SNS notification when this type of drift is detected. @@ -91 +114 @@ When this type of drift occurs for an Account Factory provisioned account in an - * Updating the provisioned product in Account Factory. For more information, see [Update and move account factory accounts with AWS Control Tower or with AWS Service Catalog](./updating-account-factory-accounts.html). + * Updating the provisioned product in Account Factory. For more information, see [Update and move accounts with AWS Control Tower](./updating-account-factory-accounts.html). @@ -101 +124 @@ If you have several individual accounts to update, also see this method for maki -In an OU with more than 1000 accounts, you _must_ resolve the drift by making an update to each moved account, either through the AWS Control Tower console or the provisioned product, because **Re-register OU** will not perform the update. For more information, see [Update and move account factory accounts with AWS Control Tower or with AWS Service Catalog](./updating-account-factory-accounts.html). +In an OU with more than 1000 accounts, you _must_ resolve the drift by making an update to each moved account, either through the AWS Control Tower console or the provisioned product, because **Re-register OU** will not perform the update. For more information, see [Update and move accounts with AWS Control Tower](./updating-account-factory-accounts.html). @@ -129 +152 @@ This type of drift can occur when a member account is removed from a registered - * When this type of drift occurs in a member account, you can resolve the drift by updating the account in the AWS Control Tower console, or in Account Factory. For example, you can add the account to another registered OU from the Account Factory update wizard. For more information, see [Update and move account factory accounts with AWS Control Tower or with AWS Service Catalog](./updating-account-factory-accounts.html). + * When this type of drift occurs in a member account, you can resolve the drift by updating the account in the AWS Control Tower console, or in Account Factory. For example, you can add the account to another registered OU from the Account Factory update wizard. For more information, see [Update and move accounts with AWS Control Tower](./updating-account-factory-accounts.html). @@ -315 +338 @@ AWS Control Tower notifies you when this type of drift occurs. For almost all ca -In the AWS Control Tower console, you can view the drift status in the **Baseline state** column on the **Organizations** page. The resolution from the console is to **Re-register** your OU or **Update** your account. +In the AWS Control Tower console, you can view this inherited drift status in the **Baseline state** column on the **Organizations** page. The resolution from the console is to **Re-register** your OU or **Update** your account. @@ -322,0 +346,18 @@ You can resolve this type of drift programmatically, by calling the [`ResetEnabl +## Inheritance drift on enabled controls + +This type of drift can occur to AWS Control Tower OUs and accounts. + +### Resolution + +AWS Control Tower notifies you when this type of drift occurs. For almost all cases of inheritance drift, you will receive an SNS notification for _Moved member account_ drift. That's because this type of drift typically occurs when an account has been moved, or an account fails enrollment. + +**View and resolve drift in the console** + +In the AWS Control Tower console, you can view this inherited drift status in the **Organizations** page, the **Enabled controls** page, and the **Account details** page. The resolution from the console is to **Re-register** your OU or **Update** your account. + +**View and resolve drift programmatically** + +To view inherited drift status for enabled controls programmatically, you can call the [`ListEnabledControls`](https://docs.aws.amazon.com/controltower/latest/APIReference/API_ListEnabledControls.html) API to view statuses for the enabled controls on your OUs. To view statuses for individual accounts programmatically with the `ListEnabledControls` API, use the `includeChildren` flag. + +You can resolve this type of inheritance drift programmatically, by calling the [`ResetEnabledControl`](https://docs.aws.amazon.com/controltower/latest/APIReference/API_ResetEnabledControl.html) API. +