AWS controltower documentation change

Service: controltower · 2025-11-22 · Documentation low

File: controltower/latest/userguide/provision-and-manage-accounts.md

Summary

Added guidance requiring AWSControlTowerBaseline activation for account provisioning and updated a URL. Clarified enrollment requirements for OUs.

Security assessment

The added text emphasizes enforcing security baselines during account provisioning, which helps prevent misconfigurations. While this improves security documentation, there is no evidence it addresses a specific active security vulnerability.

Diff

diff --git a/controltower/latest/userguide/provision-and-manage-accounts.md b/controltower/latest/userguide/provision-and-manage-accounts.md
index ad88a468b..a180db3db 100644
--- a//controltower/latest/userguide/provision-and-manage-accounts.md
+++ b//controltower/latest/userguide/provision-and-manage-accounts.md
@@ -21,0 +22,4 @@ For general information about accounts in AWS Control Tower, see [About AWS acco
+Single account provision, update and customization must target an organizational unit (OU) with AWSControlTowerBaseline enabled. If an OU does not have the AWSControlTowerBaseline enabled, you can activate account auto-enrollment or use ResetEnabledBaseline and ResetEnabledControl APIs on EnabledBaselines and EnabledControls on that OU to enroll accounts. There are no single account provisioning limitations when an OU has the AWSControlTowerBaseline enabled.
+
+###### Note
+
@@ -34 +38 @@ When provisioning an account, the account requester always must have the `Create
-For general information about permissions required in AWS Control Tower, see [Using identity-based policies (IAM policies) for AWS Control Tower](./access-control-managing-permissions.html). For information about roles and accounts in AWS Control Tower, see [Roles and accounts](https://docs.aws.amazon.com/controltower/latest/userguide/roles.html).
+For general information about permissions required in AWS Control Tower, see [Using identity-based policies (IAM policies) for AWS Control Tower](./access-control-managing-permissions.html). For information about roles and accounts in AWS Control Tower, see [Roles and accounts](https://docs.aws.amazon.com//controltower/latest/userguide/roles.html).