AWS controltower documentation change
Summary
Added a note about OU baseline requirements for account provisioning and updated URLs
Security assessment
The new note emphasizes the need for AWSControlTowerBaseline-enabled OUs and mentions security-related APIs (ResetEnabledBaseline/ResetEnabledControl). While this clarifies security best practices, there is no evidence of addressing a specific vulnerability.
Diff
diff --git a/controltower/latest/userguide/account-factory.md b/controltower/latest/userguide/account-factory.md index ff7dd86b1..12a1f2a3e 100644 --- a//controltower/latest/userguide/account-factory.md +++ b//controltower/latest/userguide/account-factory.md @@ -8,0 +9,4 @@ PermissionsAccount considerations +###### Note + +Single account provision, update and customization must target an organizational unit (OU) with AWSControlTowerBaseline enabled. If an OU does not have the AWSControlTowerBaseline enabled, you can activate account auto-enrollment or use ResetEnabledBaseline and ResetEnabledControl APIs on EnabledBaselines and EnabledControls on that OU to enroll accounts. There are no single account provisioning limitations when an OU has the AWSControlTowerBaseline enabled. + @@ -19 +23 @@ Exercise caution when working from the management account, as you would when usi -The AWS Control Tower management account has a trust relationship with the `AWSControlTowerExecution` role, which allows account setup from the management account, including some automated account setup. For more information about the `AWSControlTowerExecution` role, see [Roles and accounts](https://docs.aws.amazon.com/controltower/latest/userguide/roles-how.html). +The AWS Control Tower management account has a trust relationship with the `AWSControlTowerExecution` role, which allows account setup from the management account, including some automated account setup. For more information about the `AWSControlTowerExecution` role, see [Roles and accounts](https://docs.aws.amazon.com//controltower/latest/userguide/roles-how.html). @@ -33 +37 @@ You can update, unenroll, and close accounts that you create and provision throu -When updating a provisioned product that's associated with an account that Account Factory vends, if you specify a new user email address for AWS IAM Identity Center, AWS Control Tower creates a new user in IAM Identity Center. The previously created account isn't removed. For information about removing the previous IAM Identity Center user email address from IAM Identity Center, see [Disabling a User](https://docs.aws.amazon.com/singlesignon/latest/userguide/disableuser.html). +When updating a provisioned product that's associated with an account that Account Factory vends, if you specify a new user email address for AWS IAM Identity Center, AWS Control Tower creates a new user in IAM Identity Center. The previously created account isn't removed. For information about removing the previous IAM Identity Center user email address from IAM Identity Center, see [Disabling a User](https://docs.aws.amazon.com//singlesignon/latest/userguide/disableuser.html).