AWS controltower documentation change
Summary
Updated documentation about account provisioning methods, added details about automated enrollment feature, and restructured content for clarity
Security assessment
The changes primarily clarify provisioning workflows and introduce automated enrollment capabilities. While account enrollment processes relate to governance, there is no explicit mention of patching vulnerabilities, mitigating threats, or addressing security incidents. The updates appear focused on feature documentation rather than security-specific content.
Diff
diff --git a/controltower/latest/userguide/methods-of-provisioning.md b/controltower/latest/userguide/methods-of-provisioning.md index 0ad9fbc25..562500864 100644 --- a//controltower/latest/userguide/methods-of-provisioning.md +++ b//controltower/latest/userguide/methods-of-provisioning.md @@ -5 +5 @@ -# Methods of provisioning +# Provision accounts within AWS Control Tower @@ -11 +11 @@ AWS Control Tower provides several methods for creating and updating member acco -The standard way to create member accounts is through Account Factory, a console-based product that's part of the Service Catalog. If your landing zone is not in a state of drift, you can use **Create account** as a method to add new accounts from the console, as well as **Enroll account** to enroll existing AWS accounts into AWS Control Tower. +One standard way to create member accounts in AWS Control Tower is through Account Factory, a console-based product that's part of the Service Catalog. Also, from the AWS Control Tower console, you can use **Create account** as a method to provision new accounts, as well as **Enroll account** to enroll existing AWS accounts into AWS Control Tower, if your landing zone is not in a state of drift. @@ -13 +13 @@ The standard way to create member accounts is through Account Factory, a console -With Account Factory, you can provision basic accounts, by relying on the AWS Control Tower default settings. You also can provision customized accounts that meet requirements for specialized use cases. +With Account Factory, you can provision basic accounts, relying on the AWS Control Tower default settings. You also can provision _customized_ accounts that meet requirements for specialized use cases. @@ -15 +15,5 @@ With Account Factory, you can provision basic accounts, by relying on the AWS Co -Account Factory Customization (AFC) is a way of provisioning customized accounts from the AWS Control Tower console, and it automates the customization and deployment of your accounts. It allows console-based, automated provisioning, after some one-time setup steps, which eliminates the need to write scripts or set up pipelines. For more information, see [Customize accounts with Account Factory Customization (AFC)](./af-customization-page.html). +[Account Factory Customization (AFC)](https://docs.aws.amazon.com/controltower/latest/userguide/af-customization-page.html) is a way of provisioning customized accounts from the AWS Control Tower console, and it automates the customization and deployment of your accounts. It allows console-based, automated provisioning, after some one-time setup steps, which eliminates the need to write scripts or set up pipelines. For more information, see [Customize accounts with Account Factory Customization (AFC)](./af-customization-page.html). + +###### Automatic enrollment + +You also can create AWS accounts _outside_ AWS Control Tower and move them into an OU that's registered with AWS Control Tower, without creating inheritance drift, if you opt into the **Automated account enrollment** feature of your landing zone **Settings**. For more information, see [Move and enroll accounts with auto-enrollment](./account-auto-enrollment.html). @@ -21 +25,3 @@ Account Factory Customization (AFC) is a way of provisioning customized accounts - * Through the **Enroll account** feature within AWS Control Tower, if your landing zone is not in a state of drift. See [Enroll an existing account](./quick-account-provisioning.html). + * Through automated enrollment, by moving an account into an OU from the console. See [Move and enroll accounts with auto-enrollment](./account-auto-enrollment.html) + + * Through the **Enroll account** feature within AWS Control Tower, if your landing zone is not in a state of drift. See [Enroll an existing account from the AWS Control Tower console](./quick-account-provisioning.html). @@ -33,0 +40,2 @@ Account Factory Customization (AFC) is a way of provisioning customized accounts + * Through automated enrollment, by moving an existing account into an OU using APIs. See [Move and enroll accounts with auto-enrollment](./account-auto-enrollment.html) + @@ -49 +57 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Accounts +Provision and manage accounts @@ -51 +59 @@ Accounts -Permissions required +Provision accounts in console