AWS controltower documentation change
Summary
Added documentation for AWS Control Tower landing zone version 4.0, which introduces flexible service integrations, dedicated resources, organizational structure changes, and AWS Config improvements. Updated the number of added AWS Config controls from 'all' to 'additional 279'. Made minor link formatting corrections.
Security assessment
The changes primarily document new architectural features (like optional security service integrations and dedicated resources) and expanded control coverage. While these features can enhance security posture through better isolation and governance capabilities, there's no evidence of addressing a specific vulnerability or security incident. The documentation adds details about security features (AWS Config/CloudTrail integration options) but doesn't reference any CVE, exploit, or security patch.
Diff
diff --git a/controltower/latest/userguide/2025-all.md b/controltower/latest/userguide/2025-all.md index 8b4a086a4..df776023d 100644 --- a//controltower/latest/userguide/2025-all.md +++ b//controltower/latest/userguide/2025-all.md @@ -5 +5 @@ -AWS Control Tower adds all AWS Config controls to Control CatalogAWS Control Tower available in Asia Pacific (New Zealand) RegionAWS Control Tower supports automatic account enrollmentAWS Control Tower updates Python versionAWS Control Tower reduces driftAWS Control Tower supports IPv6 addresses Account Factory for Terraform version 1.15.0 availableUpdated controls with Nitro instance typesAWS Control Tower available in Asia Pacific (Taipei) RegionAWS Control Tower supports PrivateLinkSupport for additional industry frameworks, updated metadataService-linked AWS Config controls Enabled controls console view gives centralized visibility Account Factory for Terraform (AFT) supports new configurations at deploymentAWS Control Tower introduces account-level reporting for baseline APIsAWS Control Tower available in AWS Asia Pacific (Thailand) and Mexico (Central) RegionsAdditional AWS Config controls availableDeregister and delete actions for OUsControl Catalog supports IPv6 addresses +AWS Control Tower landing zone version 4.0AWS Control Tower adds additional 279 AWS Config controls to Control CatalogAWS Control Tower available in Asia Pacific (New Zealand) RegionAWS Control Tower supports automatic account enrollmentAWS Control Tower updates Python versionAWS Control Tower reduces driftAWS Control Tower supports IPv6 addresses Account Factory for Terraform version 1.15.0 availableUpdated controls with Nitro instance typesAWS Control Tower available in Asia Pacific (Taipei) RegionAWS Control Tower supports PrivateLinkSupport for additional industry frameworks, updated metadataService-linked AWS Config controls Enabled controls console view gives centralized visibility Account Factory for Terraform (AFT) supports new configurations at deploymentAWS Control Tower introduces account-level reporting for baseline APIsAWS Control Tower available in AWS Asia Pacific (Thailand) and Mexico (Central) RegionsAdditional AWS Config controls availableDeregister and delete actions for OUsControl Catalog supports IPv6 addresses @@ -11 +11,3 @@ Since January 2025, AWS Control Tower has released the following updates: - * AWS Control Tower adds all AWS Config controls to Control Catalog + * AWS Control Tower landing zone version 4.0 + + * AWS Control Tower adds additional 279 AWS Config controls to Control Catalog @@ -52 +54,74 @@ Account Factory for Terraform version 1.15.0 available -## AWS Control Tower adds all AWS Config controls to Control Catalog +## AWS Control Tower landing zone version 4.0 + +**November 17, 2025** + +(Update required for AWS Control Tower landing zone to version 4.0. For information, see [Update your landing zone](./update-controltower.html)). + +AWS Control Tower landing zone 4.0 is a major update that introduces a flexible Controls-Only experience, allowing customers to customize how they implement and manage their AWS multi-account environment. This release significantly changes how AWS Control Tower integrates with AWS services and manages organizational resources. + +###### Key Changes and Features + + * Optional Service Integrations - landing zone 4.0 lets you choose which service integrations to enable in your environment. Disabling an integration will clean up the AWS Control Tower deployed resources specific to that integration in the managed accounts and the service integration central accounts. You can now selectively enable or disable service integrations: + + * AWS Config + + * AWS CloudTrail + + * Security Roles + + * AWS Backup + + + + +_Important: If you want to disable AWS Config integration, you must also disable Security Roles, IAM Identity Center, and AWS Backup integrations._ + + * Dedicated Resources instead of using shared resources - landing zone 4.0 now creates dedicated resources for key services. This separation provides better resource isolation and more granular control over service-specific resources: + + * Separate S3 buckets for AWS Config + + * Separate S3 buckets for AWS CloudTrail + + * Individual SNS topics for each service + + + + + * Flexible Organization Structure - landing zone 4.0 removes previous organizational structure requirements: + + * You are no longer required to use a Security OU + + * You can define your own organizational structure + + * The only requirement is that all hub accounts must be in the same OU + + * Dedicated controls experience - You can now create a minimal landing zone setup that includes: + + * Basic AWS Organizations integration + + * Ability to enable controls without enabling the `AWSControlTowerBaseline` baseline + + * Custom governance configurations based on your needs + + * AWS Config Changes - Landing Zone 4.0 introduces several improvements to the AWS Config integration implementation: + + * A new Config spoke baseline specifically for detective controls + + * Service-linked Config aggregator (SLCA) in the Config hub account + + * Replacement of traditional organization and account aggregators + + * Optional Manifest: + + * The manifest field is now optional, allowing you: + + * Create landing zones without any service integrations + + * More flexibility in initial setup + + * Customized deployment options + + + + +## AWS Control Tower adds additional 279 AWS Config controls to Control Catalog @@ -58 +133 @@ Account Factory for Terraform version 1.15.0 available -The AWS Control Tower now includes all AWS Config controls as part of the Control Catalog. You can view the controls in the AWS Control Tower console, and through the APIs. +The AWS Control Tower now includes additional 279 AWS Config controls as part of the Control Catalog. You can view the controls in the AWS Control Tower console, and through the APIs. @@ -88 +163 @@ For more information about auto-enrollment, see [Optionally configure auto-enrol -This release also includes an update to a managed policy and a new managed policy. We updated the [AWSControlTowerServiceRolePolicy](https://docs.aws.amazon.com/controltower/latest/userguide/managed-policies-table.html) and added the new [AWSControlTowerIdentityCenterManagementPolicy](https://docs.aws.amazon.com/controltower/latest/userguide/managed-policies-table.html). +This release also includes an update to a managed policy and a new managed policy. We updated the [AWSControlTowerServiceRolePolicy](https://docs.aws.amazon.com//controltower/latest/userguide/managed-policies-table.html) and added the new [AWSControlTowerIdentityCenterManagementPolicy](https://docs.aws.amazon.com//controltower/latest/userguide/managed-policies-table.html). @@ -149 +224 @@ AWS Control Tower has updated the eight proactive controls in the Control Catalo - * [`CT.EC2.PR.15`](https://docs.aws.amazon.com/controltower/latest/controlreference/ec2-rules.html#ct-ec2-pr-15-description) + * [`CT.EC2.PR.15`](https://docs.aws.amazon.com//controltower/latest/controlreference/ec2-rules.html#ct-ec2-pr-15-description) @@ -151 +226 @@ AWS Control Tower has updated the eight proactive controls in the Control Catalo - * [`CT.EC2.PR.16`](https://docs.aws.amazon.com/controltower/latest/controlreference/ec2-rules.html#ct-ec2-pr-16-description) + * [`CT.EC2.PR.16`](https://docs.aws.amazon.com//controltower/latest/controlreference/ec2-rules.html#ct-ec2-pr-16-description) @@ -153 +228 @@ AWS Control Tower has updated the eight proactive controls in the Control Catalo - * [`CT.EC2.PR.17`](https://docs.aws.amazon.com/controltower/latest/controlreference/ec2-rules.html#ct-ec2-pr-17-description) + * [`CT.EC2.PR.17`](https://docs.aws.amazon.com//controltower/latest/controlreference/ec2-rules.html#ct-ec2-pr-17-description) @@ -155 +230 @@ AWS Control Tower has updated the eight proactive controls in the Control Catalo - * [`CT.EC2.PR.18`](https://docs.aws.amazon.com/controltower/latest/controlreference/ec2-rules.html#ct-ec2-pr-18-description) + * [`CT.EC2.PR.18`](https://docs.aws.amazon.com//controltower/latest/controlreference/ec2-rules.html#ct-ec2-pr-18-description) @@ -157 +232 @@ AWS Control Tower has updated the eight proactive controls in the Control Catalo - * [`CT.EC2.PR.19`](https://docs.aws.amazon.com/controltower/latest/controlreference/ec2-rules.html#ct-ec2-pr-19-description) + * [`CT.EC2.PR.19`](https://docs.aws.amazon.com//controltower/latest/controlreference/ec2-rules.html#ct-ec2-pr-19-description) @@ -159 +234 @@ AWS Control Tower has updated the eight proactive controls in the Control Catalo - * [`CT.EC2.PR.20`](https://docs.aws.amazon.com/controltower/latest/controlreference/ec2-rules.html#ct-ec2-pr-20-description) + * [`CT.EC2.PR.20`](https://docs.aws.amazon.com//controltower/latest/controlreference/ec2-rules.html#ct-ec2-pr-20-description) @@ -220 +295 @@ AWS Control Tower now supports [AWS PrivateLink](https://aws.amazon.com/privatel -With this release, AWS Control Tower expands to include support for 10 industry frameworks. For a list of frameworks, see [Frameworks supported](https://docs.aws.amazon.com/controltower/latest/controlreference/frameworks-supported.html). +With this release, AWS Control Tower expands to include support for 10 industry frameworks. For a list of frameworks, see [Frameworks supported](https://docs.aws.amazon.com//controltower/latest/controlreference/frameworks-supported.html). @@ -222 +297 @@ With this release, AWS Control Tower expands to include support for 10 industry -For example, you can get started by navigating to the Control Catalog page in the AWS Control Tower console and searching for a framework, such as **PCI-DSS-v4.0** , to view all controls related to that framework. Or you can examine controls and frameworks programmatically, by calling the new [`ListControlMappings`](https://docs.aws.amazon.com/controlcatalog/latest/APIReference/API_ListControlMappings.html) API. +For example, you can get started by navigating to the Control Catalog page in the AWS Control Tower console and searching for a framework, such as **PCI-DSS-v4.0** , to view all controls related to that framework. Or you can examine controls and frameworks programmatically, by calling the new [`ListControlMappings`](https://docs.aws.amazon.com//controlcatalog/latest/APIReference/API_ListControlMappings.html) API. @@ -226 +301 @@ The metadata definitions associated with controls are changing, to better suppor -In the console and the API, we introduced 3 new metadata fields. Collectively, these fields describe a hierarchy that helps you understand how to categorize and enable controls. The fields are: **Domain** , **Objective** , and [**Common control**](https://docs.aws.amazon.com/controltower/latest/controlreference/common-controls-list.html). We have redefined our [control objectives](https://docs.aws.amazon.com/controltower/latest/controlreference/control-catalog-objectives.html) to align better with the broader scope of industry frameworks that are available. For more information about this hierarchy, see [Ontology overview](https://docs.aws.amazon.com/controlcatalog/latest/userguide/ontology-overview.html). +In the console and the API, we introduced 3 new metadata fields. Collectively, these fields describe a hierarchy that helps you understand how to categorize and enable controls. The fields are: **Domain** , **Objective** , and [**Common control**](https://docs.aws.amazon.com//controltower/latest/controlreference/common-controls-list.html). We have redefined our [control objectives](https://docs.aws.amazon.com/controltower/latest/controlreference/control-catalog-objectives.html) to align better with the broader scope of industry frameworks that are available. For more information about this hierarchy, see [Ontology overview](https://docs.aws.amazon.com/controlcatalog/latest/userguide/ontology-overview.html). @@ -232 +307 @@ In the console and the API, we introduced 3 new metadata fields. Collectively, t - * Each control now has a new field called `GovernedResources`, which shows the resource types that the control governs. In some cases, this field shows the service prefix for the resources, and in other instances, it can be blank. For more information, see [`GetControl`](https://docs.aws.amazon.com/controlcatalog/latest/APIReference/API_GetControl.html) and [`ListControls`](https://docs.aws.amazon.com/controlcatalog/latest/APIReference/API_ListControls.html). + * Each control now has a new field called `GovernedResources`, which shows the resource types that the control governs. In some cases, this field shows the service prefix for the resources, and in other instances, it can be blank. For more information, see [`GetControl`](https://docs.aws.amazon.com//controlcatalog/latest/APIReference/API_GetControl.html) and [`ListControls`](https://docs.aws.amazon.com//controlcatalog/latest/APIReference/API_ListControls.html). @@ -272 +347 @@ The intended functionality of controls, when implemented by service-linked AWS C -As part of this release, we added four new permissions to the policy for the service-linked role (SLR) [`AWSServiceRoleForAWSControlTower`](https://docs.aws.amazon.com/controltower/latest/userguide/access-control-managing-permissions.html#AWSServiceRoleForAWSControlTower), so that you can enable and disable service-linked AWS Config rules for your enrolled accounts. +As part of this release, we added four new permissions to the policy for the service-linked role (SLR) [`AWSServiceRoleForAWSControlTower`](https://docs.aws.amazon.com//controltower/latest/userguide/access-control-managing-permissions.html#AWSServiceRoleForAWSControlTower), so that you can enable and disable service-linked AWS Config rules for your enrolled accounts. @@ -308 +383 @@ For more information, see [Deploy AWS Control Tower Account Factory for Terrafor -You can now view _drift_ and _account enrollment_ statuses programmatically for your governed accounts, by calling the baseline APIs. With this capability, you can identify when account and OU baseline configurations are _drifted_ , or out of sync. To view the drift status programmatically, you can call the [`ListEnabledBaselines`](https://docs.aws.amazon.com/controltower/latest/APIReference/API_ListEnabledBaselines.html) API for your enabled baselines. To view statuses for individual accounts programmatically with the `ListEnabledBaselines` API, use the `includeChildren` flag. You can filter by these statuses, and see only the accounts and OUs that require your attention. +You can now view _drift_ and _account enrollment_ statuses programmatically for your governed accounts, by calling the baseline APIs. With this capability, you can identify when account and OU baseline configurations are _drifted_ , or out of sync. To view the drift status programmatically, you can call the [`ListEnabledBaselines`](https://docs.aws.amazon.com//controltower/latest/APIReference/API_ListEnabledBaselines.html) API for your enabled baselines. To view statuses for individual accounts programmatically with the `ListEnabledBaselines` API, use the `includeChildren` flag. You can filter by these statuses, and see only the accounts and OUs that require your attention. @@ -310 +385 @@ You can now view _drift_ and _account enrollment_ statuses programmatically for -The [`AWSControlTowerBaseline`](https://docs.aws.amazon.com/controltower/latest/userguide/types-of-baselines.html#ou-baseline-types) sets up best practice configurations, controls, and resources that are required for governance. When you enable this baseline on an organizational unit (OU), member accounts within the OU are enrolled into AWS Control Tower automatically. The AWS Control Tower baseline APIs include CloudFormation support, which allows you to build automations that manage your OUs and accounts with infrastructure as code (IaC). +The [`AWSControlTowerBaseline`](https://docs.aws.amazon.com//controltower/latest/userguide/types-of-baselines.html#ou-baseline-types) sets up best practice configurations, controls, and resources that are required for governance. When you enable this baseline on an organizational unit (OU), member accounts within the OU are enrolled into AWS Control Tower automatically. The AWS Control Tower baseline APIs include CloudFormation support, which allows you to build automations that manage your OUs and accounts with infrastructure as code (IaC). @@ -312 +387 @@ The [`AWSControlTowerBaseline`](https://docs.aws.amazon.com/controltower/latest/ -To learn more about these APIs, review [Baselines](https://docs.aws.amazon.com/controltower/latest/userguide/types-of-baselines.html) in the _AWS Control Tower User Guide_. The baseline APIs and newly launched reporting capabilities for _drift_ and _account enrollment_ status are available in all AWS Regions where AWS Control Tower is available. For a list of AWS Regions where AWS Control Tower is available, see the [AWS Region Table](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/). +To learn more about these APIs, review [Baselines](https://docs.aws.amazon.com//controltower/latest/userguide/types-of-baselines.html) in the _AWS Control Tower User Guide_. The baseline APIs and newly launched reporting capabilities for _drift_ and _account enrollment_ status are available in all AWS Regions where AWS Control Tower is available. For a list of AWS Regions where AWS Control Tower is available, see the [AWS Region Table](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/).