AWS controltower documentation change
Summary
Added documentation about enabling controls on OUs in Landing Zone v4.0 and fixed URL formatting
Security assessment
The change adds information about enabling detective controls requiring AWS Config recording, which relates to security monitoring capabilities. However, there's no evidence of addressing a specific security vulnerability.
Diff
diff --git a/controltower/latest/userguide/importing-existing.md b/controltower/latest/userguide/importing-existing.md index 62f29217a..1a3bebeb2 100644 --- a//controltower/latest/userguide/importing-existing.md +++ b//controltower/latest/userguide/importing-existing.md @@ -12,0 +13,2 @@ When you register an OU, its member accounts are enrolled into the AWS Control T +Starting with Landing Zone version 4.0, you can directly enable controls on an OU. Detective controls require AWS Config recording which can be activated by registering the OU or enabling AWS Config recording on the OU. Register OU will enable `AWSControlTowerBaseline`. Enable AWS Config recording will enable `ConfigBaseline`. For more information, see [Types of baselines](./types-of-baselines.html) and [The AWS Control Tower Controls Reference Guide](./link-to-new-guide.html) + @@ -38 +40 @@ Your AWS Identity and Access Management (IAM) identity (user or role) or IAM Ide -The relevant portfolio is one created by AWS Control Tower, called **AWS Control Tower Account Factory Portfolio**. Navigate to it by choosing **Service Catalog > Account Factory > AWS Control Tower Account Factory Portfolio**. Then select the tab called **Groups, roles, and users** to view your IAM or IAM Identity Center identity. For more information on how to grant access, see [the documentation for AWS Service Catalog.](https://docs.aws.amazon.com/servicecatalog/latest/adminguide/catalogs_portfolios_users.html) +The relevant portfolio is one created by AWS Control Tower, called **AWS Control Tower Account Factory Portfolio**. Navigate to it by choosing **Service Catalog > Account Factory > AWS Control Tower Account Factory Portfolio**. Then select the tab called **Groups, roles, and users** to view your IAM or IAM Identity Center identity. For more information on how to grant access, see [the documentation for AWS Service Catalog.](https://docs.aws.amazon.com//servicecatalog/latest/adminguide/catalogs_portfolios_users.html)