AWS controltower medium security documentation change
Summary
Updated documentation history with new landing zone version 4.0 details, added 279 AWS Config controls, updated managed policies (including AWSControlTowerServiceRolePolicy for CloudTrail log group pattern changes), and introduced AWSControlTowerCloudTrailRolePolicy. Fixed URL formatting in IAM best practices link.
Security assessment
The AWSControlTowerServiceRolePolicy update modifies CloudWatch Logs resource patterns to prevent naming conflicts during CloudTrail integration, addressing potential logging gaps. The new AWSControlTowerCloudTrailRolePolicy replaces inline policies with managed policies to enable automatic security updates. These changes directly impact security posture by ensuring reliable logging and maintainable permissions.
Diff
diff --git a/controltower/latest/userguide/doc-history.md b/controltower/latest/userguide/doc-history.md index 9c964cf10..48fccde09 100644 --- a//controltower/latest/userguide/doc-history.md +++ b//controltower/latest/userguide/doc-history.md @@ -16 +16,5 @@ Change| Description| Date -AWS Control Tower includes all AWS Config controls| Updated Control Catalog to include all AWS Config controls.| November 14, 2025 +AWS Control Tower landing zone version 4.0 with dedicated controls environment| AWS Control Tower landing zone version 4.0 is now available with optional service integrations and a dedicated controls enviroment | November 17, 2025 +AWS Control Tower includes additional 279 AWS Config controls| Updated Control Catalog to include additional 279 AWS Config controls.| November 14, 2025 +Update to managed policy| Updated [AWSControlTowerAccountServiceRolePolicy](https://docs.aws.amazon.com//controltower/latest/userguide/managed-policies-table.html).| November 10, 2025 +Updated managed policy| Updated [AWSControlTowerServiceRolePolicy](https://docs.aws.amazon.com/controltower/latest/userguide/access-control-managing-permissions.html#AWSControlTowerServiceRolePolicy) to support Landing Zone 4.0's optional AWS CloudTrail integration. The Amazon CloudWatch Logs resource pattern changed from `aws-controltower/CloudTrailLogs:*` to `aws-controltower/CloudTrailLogs*:*` to allow management of log groups with unique suffixes. This backward-compatible update enables customers to enable and disable AWS CloudTrail integration multiple times, with log groups recreated with unique suffixes each time to avoid naming conflicts.| November 5, 2025 +New managed policy| Added documentation for [AWSControlTowerCloudTrailRolePolicy](https://docs.aws.amazon.com/access-control-managing-permissions.html#AWSControlTowerCloudTrailRolePolicy) managed policy. This managed policy replaces the inline policy previously used by the AWSControlTowerCloudTrailRole, enabling AWS to update the policy without customer intervention.| November 5, 2025 @@ -19 +23 @@ AWS Control Tower supports automatic account enrollment| Automatic account enrol -Update to managed policy, new managed policy| Updated [AWSControlTowerServiceRolePolicy](https://docs.aws.amazon.com/controltower/latest/userguide/managed-policies-table.html) and added new [AWSControlTowerIdentityCenterManagementPolicy](https://docs.aws.amazon.com/controltower/latest/userguide/managed-policies-table.html).| October 14, 2025 +Update to managed policy, new managed policy| Updated [AWSControlTowerServiceRolePolicy](https://docs.aws.amazon.com//controltower/latest/userguide/managed-policies-table.html) and added new [AWSControlTowerIdentityCenterManagementPolicy](https://docs.aws.amazon.com//controltower/latest/userguide/managed-policies-table.html).| October 14, 2025 @@ -80 +84 @@ Account customization request tracing generally available | AWS Control Tower n -IAM best practices update| Updated guide to align with the IAM best practices recommendations. For more information, see [Security best practices in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html).| February 15, 2023 +IAM best practices update| Updated guide to align with the IAM best practices recommendations. For more information, see [Security best practices in IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html).| February 15, 2023