AWS controltower documentation change
Summary
Updated baseline version table: removed 'Included controls' column, added baseline version 5.0, and documented removal of AWS Config Aggregation Authorizations due to AWS Organizations Config Aggregator adoption.
Security assessment
The change documents an architectural improvement (AWS Organizations Config Aggregator) that centralizes security monitoring, reducing redundant permissions. While this enhances security posture, there is no evidence of addressing a specific security vulnerability. The update adds documentation about a security-related feature (centralized configuration aggregation).
Diff
diff --git a/controltower/latest/userguide/table-of-baselines.md b/controltower/latest/userguide/table-of-baselines.md index efc2971cb..0f0ec37b3 100644 --- a//controltower/latest/userguide/table-of-baselines.md +++ b//controltower/latest/userguide/table-of-baselines.md @@ -19,8 +19,9 @@ For the OU-level baseline, `AWSControlTowerBaseline`, the table that follows sho -**Baseline version** | **Landing zone versions** | **Included blueprints** | **Included controls** | **Change from previous baseline** ----|---|---|---|--- -1.0 | 2.0 to 2.7 | BP_BASELINE_CLOUDTRAIL, BP_BASELINE_CLOUDWATCH, BP_BASELINE_CONFIG, BP_BASELINE_ROLES, BP_BASELINE_SERVICE_ROLES, IAM Resources | All mandatory controls | None -2.0 | 2.8 to 2.9 | BP_BASELINE_CLOUDTRAIL, BP_BASELINE_CLOUDWATCH, BP_BASELINE_CONFIG, BP_BASELINE_ROLES, BP_BASELINE_SERVICE_ROLES, Config SLR, IAM resources | All mandatory controls | Added AWS Config service-linked role (SLR) and new Config blueprint to use the SLR -3.0 | 3.0 to 3.1 | BP_BASELINE_CLOUDWATCH, BP_BASELINE_CONFIG, BP_BASELINE_ROLES, BP_BASELINE_SERVICE_ROLES, Config SLR, IAM resources | All mandatory controls | New AWS Config blueprint. Change to record global resources only in home Region. Removed CloudTrail blueprint -4.0 | 3.2 to 3.3 | BP_BASELINE_CLOUDWATCH, BP_BASELINE_CONFIG, BP_BASELINE_ROLES, BP_BASELINE_SERVICE_LINKED_ROLE, BP_BASELINE_SERVICE_ROLES, Config SLR, IAM resources | All mandatory controls | New SLR blueprint - -For more information about specific resources created in accounts when you set up your landing zone, see [Resources created in the shared accounts](https://docs.aws.amazon.com/controltower/latest/userguide/shared-account-resources.html). +**Baseline version** | **Landing zone versions** | **Included blueprints** | **Change from previous baseline** +---|---|---|--- +1.0 | 2.0 to 2.7 | BP_BASELINE_CLOUDTRAIL, BP_BASELINE_CLOUDWATCH, BP_BASELINE_CONFIG, BP_BASELINE_ROLES, BP_BASELINE_SERVICE_ROLES, IAM Resources | None +2.0 | 2.8 to 2.9 | BP_BASELINE_CLOUDTRAIL, BP_BASELINE_CLOUDWATCH, BP_BASELINE_CONFIG, BP_BASELINE_ROLES, BP_BASELINE_SERVICE_ROLES, Config SLR, IAM resources | Added AWS Config service-linked role (SLR) and new Config blueprint to use the SLR +3.0 | 3.0 to 3.1 | BP_BASELINE_CLOUDWATCH, BP_BASELINE_CONFIG, BP_BASELINE_ROLES, BP_BASELINE_SERVICE_ROLES, Config SLR, IAM resources | New AWS Config blueprint. Change to record global resources only in home Region. Removed CloudTrail blueprint +4.0 | 3.2 to 3.3 | BP_BASELINE_CLOUDWATCH, BP_BASELINE_CONFIG, BP_BASELINE_ROLES, BP_BASELINE_SERVICE_LINKED_ROLE, BP_BASELINE_SERVICE_ROLES, Config SLR, IAM resources | New SLR blueprint +5.0 | 4.0 | BP_BASELINE_CLOUDWATCH, BP_BASELINE_CONFIG, BP_BASELINE_ROLES, BP_BASELINE_SERVICE_LINKED_ROLE, BP_BASELINE_SERVICE_ROLES, Config SLR, IAM resources | Removed AWS Config Aggregation Authorization(s). AWS Config Aggregation Authorization from each member account is not needed since LandingZone version 4.0 adopted AWS Organizations Config Aggregator which has access to all member accounts within the Organization. + +For more information about specific resources created in accounts when you set up your landing zone, see [Resources created in the shared accounts](https://docs.aws.amazon.com//controltower/latest/userguide/shared-account-resources.html).