AWS controltower documentation change
Summary
Restructured enrollment documentation to include auto-enrollment option, clarified prerequisites, and reorganized console enrollment steps. Added considerations section about landing zone drift state and permissions requirements.
Security assessment
The changes primarily improve procedural clarity and add a new auto-enrollment feature description. While there are mentions of required permissions (AWSServiceCatalogEndUserFullAccess, Administrator access) and a warning against using root user, these are standard operational security practices rather than responses to specific vulnerabilities. No evidence of addressing a newly discovered security flaw or weakness.
Diff
diff --git a/controltower/latest/userguide/quick-account-provisioning.md b/controltower/latest/userguide/quick-account-provisioning.md index e9525c845..fdadcff80 100644 --- a//controltower/latest/userguide/quick-account-provisioning.md +++ b//controltower/latest/userguide/quick-account-provisioning.md @@ -5 +5 @@ -Steps to enroll an account manuallyCommon causes for failure of enrollment +Considerations for enrolling from the consoleSteps to enroll an account manuallyCommon causes for failure of enrollment @@ -7 +7 @@ Steps to enroll an account manuallyCommon causes for failure of enrollment -# Enroll an existing account +# Enroll an existing account from the AWS Control Tower console @@ -9 +9 @@ Steps to enroll an account manuallyCommon causes for failure of enrollment -The **Enroll account** feature is available in the AWS Control Tower console, for enrolling existing AWS accounts so that they are governed by AWS Control Tower. For more information, see [Enroll an existing AWS account](https://docs.aws.amazon.com/controltower/latest/userguide/enroll-account.html). +Two common ways exist to enroll an individual AWS account into AWS Control Tower. @@ -11 +11 @@ The **Enroll account** feature is available in the AWS Control Tower console, fo -The **Enroll account** capability is available when your landing zone is not in a state of [drift](https://docs.aws.amazon.com/controltower/latest/userguide/drift.html). + 1. After you select the _auto-enrollment_ feature in the **Settings** page, you can create an AWS account outside of AWS Control Tower and move it directly into a registered OU. For more information, see [Move and enroll accounts automatically](https://docs.aws.amazon.com/controltower/latest/userguide/account-auto-enroll.html). This option is available for landing zone versions 3.1 and later. @@ -13 +13 @@ The **Enroll account** capability is available when your landing zone is not in -**To view your eligible accounts in the console:** + 2. You can enroll an existing account from the AWS Control Tower console manually. @@ -15 +14,0 @@ The **Enroll account** capability is available when your landing zone is not in - * Navigate to the **Organization** page in AWS Control Tower. @@ -17 +15,0 @@ The **Enroll account** capability is available when your landing zone is not in - * Find the name of the account you wish to enroll. To find it, choose **Accounts only** from the dropdown menu at the upper right, and then locate the account name in the filtered table. @@ -19 +16,0 @@ The **Enroll account** capability is available when your landing zone is not in - * Follow the steps for enrolling an individual account, as shown in the Steps to enroll an account manually section. @@ -20,0 +18 @@ The **Enroll account** capability is available when your landing zone is not in +**The following sections describe the second option,** which requres no previous configuration of your AWS Control Tower environment. The AWS account must fulfill the required [prerequisites](https://docs.aws.amazon.com/controltower/latest/userguide/enrollment-prerequisites.html). @@ -21,0 +20 @@ The **Enroll account** capability is available when your landing zone is not in +**View your eligible accounts in the console:** @@ -22,0 +22 @@ The **Enroll account** capability is available when your landing zone is not in + 1. Navigate to the **Organization** page in AWS Control Tower. @@ -24 +24 @@ The **Enroll account** capability is available when your landing zone is not in -###### Note + 2. Find the name of the account you wish to enroll. To find it, choose **Accounts only** from the dropdown menu at the upper right, and then locate the account name in the filtered table. @@ -26 +25,0 @@ The **Enroll account** capability is available when your landing zone is not in -When you are enrolling an existing AWS account, be sure to verify the existing email address. Otherwise, a new account may be created. @@ -28 +26,0 @@ When you are enrolling an existing AWS account, be sure to verify the existing e -Certain errors may require that you refresh the page and try again. If your landing zone is in a state of drift, you may not be able to use the **Enroll account** capability successfully. You'll need to provision new accounts through Account Factory until your landing zone drift has been resolved. @@ -30 +27,0 @@ Certain errors may require that you refresh the page and try again. If your land -When you enroll accounts from the AWS Control Tower console, you must be signed into an account with a user that has the `AWSServiceCatalogEndUserFullAccess` policy enabled, along with Administrator access permissions to use the AWS Control Tower console, and you cannot be signed in as the root user. @@ -32 +29,18 @@ When you enroll accounts from the AWS Control Tower console, you must be signed -Accounts that you enroll may be updated by means of the AWS Control Tower account factory, as you would update any other account. Update procedures are given in the section called [Update and move account factory accounts with AWS Control Tower or with AWS Service Catalog](./updating-account-factory-accounts.html). +Next, follow the steps for enrolling an individual account, as shown in the Steps to enroll an account manually section. + +## Considerations for enrolling from the console + + * The **Enroll account** feature available in the AWS Control Tower console is intended for enrolling existing AWS accounts so that they are governed by AWS Control Tower. For more information, see [Enroll an existing AWS account](https://docs.aws.amazon.com/controltower/latest/userguide/enroll-account.html). + + * The console-based **Enroll account** capability is available when your landing zone is not in a state of [drift](https://docs.aws.amazon.com/controltower/latest/userguide/drift.html). If your landing zone is in a state of drift, you may not be able to use the **Enroll account** capability successfully. You'll need to provision new accounts through Account Factory or another method, until your landing zone drift has been resolved. + + * When you enroll accounts from the AWS Control Tower console, you must be signed into an account with a user that has the `AWSServiceCatalogEndUserFullAccess` policy enabled, along with **Administrator** access permissions to use the AWS Control Tower console, and you cannot be signed in as the root user. + + * Accounts that you enroll may be updated by means of the AWS Control Tower Account Factory, as you would update any other account. Update procedures are given in the section called [Update and move accounts with AWS Control Tower](./updating-account-factory-accounts.html). + + + + +###### Note + +When you are enrolling an existing AWS account, be sure to verify the existing email address. Otherwise, a new account may be created. @@ -36 +50 @@ Accounts that you enroll may be updated by means of the AWS Control Tower accoun -After the **AdministratorAccess** permission (policy) is in place in your existing account, follow these steps to enroll the account: +After the **AdministratorAccess** access permission (policy) is in place in your existing AWS account account, follow these steps to enroll the account: @@ -109 +123 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Prerequisites for enrollment +Auto-enrollment option