AWS controltower medium security documentation change
Summary
Restructured documentation for AWS Control Tower Landing Zone v4.0 with updated service integration dependencies, organization structure changes, drift notification updates, and migration prerequisites. Added details about Service-Linked Role retention and policy requirements.
Security assessment
The change explicitly requires updating the AWSControlTowerCloudTrailRole to use a managed policy instead of inline policies, which improves security by enforcing least-privilege managed policies. This addresses potential security risks from overly permissive inline policies. The documentation also emphasizes Service-Linked Role retention policies that prevent accidental deletion of security-critical roles.
Diff
diff --git a/controltower/latest/userguide/key-changes-lz-v4.md b/controltower/latest/userguide/key-changes-lz-v4.md index fb5a3d60e..0ee8e71ff 100644 --- a//controltower/latest/userguide/key-changes-lz-v4.md +++ b//controltower/latest/userguide/key-changes-lz-v4.md @@ -5 +5 @@ -# Key Changes +# Key changes @@ -7 +7 @@ - * **Optional Service Integrations:** You now have the ability to enable/disable all AWS Control Tower integrations including AWS Config, AWS CloudTrail, SecurityRoles, and AWS Backup. These integrations also now have optionally required `enabled` flags in the API. The baselines that may apply to your landing zone or shared accounts now have dependencies on one another. The Integrations specific dependencies are: +###### Note @@ -9 +9 @@ - * Enablement: + * The definition of “registered” and “enrolled” have shifted with this new version of AWS Control Tower. When your account/OU has any AWS Control Tower resource enabled on it (e.g. control or baseline), it will be considered a governed resource. The definition will no longer be driven by the presence of the `AWSControlTowerBaseline` baseline. @@ -11 +11 @@ - * `CentralSecurityRolesBaseline` → requires `CentralConfigBaseline` to be enabled + * Service-Linked Roles are retained across all landing zone versions and are no longer deleted when OUs become "unregistered" @@ -13 +13 @@ - * `IdentityCenterBaseline` → requires `CentralSecurityRolesBaseline` to be enabled + * Service-Linked Roles can only be deleted manually by customers after landing zone decommissioning @@ -15 +14,0 @@ - * `BackupCentralVaultBaseline` → requires `CentralSecurityRolesBaseline` to be enabled @@ -17 +15,0 @@ - * `BackupAdminBaseline` → requires `CentralSecurityRolesBaseline` to be enabled @@ -19 +16,0 @@ - * `LogArchiveBaseline` → independent (no dependencies) @@ -21 +18 @@ - * `CentralConfigBaseline` → independent (no dependencies) + * **Pre-requisite for Landing Zone 4.0:** When upgrading to version 4.0 via API, ensure the `AWSControlTowerCloudTrailRole` service role uses the new managed policy `AWSControlTowerCloudTrailRolePolicy` instead of the existing inline policy. Detach the current inline policy and attach the new managed policy as described in the [documentation](https://docs.aws.amazon.com/access-control-managing-permissions.html#AWSControlTowerCloudTrailRolePolicy). @@ -23 +20 @@ - * Disablement: + * **Optional Manifest:** Manifest field in the landing zone API is now optional. Customers can create Landing Zones without any service integrations. There is no impact for existing customers that are already using the manifest field. @@ -25 +22 @@ - * `CentralConfigBaseline` can only be disabled if `CentralSecurityRolesBaseline`, `IdentityCenterBaseline`, `BackupAdminBaseline` and `BackupCentralVaultBaseline` baselines are disabled first. + * **Optional Organization Structure:** AWS Control Tower no longer enforces or manages the Security OU creation so customers can define and manage their own organization structure. However, AWS Control Tower will require all accounts that are configured for each AWS service integration to be under the same parent OU. There is no impact for customers that have already set-up the AWS Control Tower and have the Security OU. AWS Control Tower automatically deploys the resources and controls necessary to manage service integration accounts in the Security OU. For example, when AWS Config integration is enabled, AWS Config recording is enabled in all service integration accounts. The AWS Control Tower Baseline and the AWS Config Baseline are not applicable to the Security OU and integration accounts. To change service integrations, update landing zone settings. @@ -27 +24 @@ - * `CentralSecurityRolesBaseline` can only be disabled if `IdentityCenterBaseline`, `BackupAdminBaseline` and `BackupCentralVaultBaseline` baselines are disabled first. +###### Note @@ -29 +26 @@ - * `IdentityCenterBaseline` can be disabled independently. + * The organization structure setup for AWS Control Tower landing zone 4.0 has changed from previous landing zone versions. AWS Control Tower will no longer create the designated Security OU. The OU with the service integration accounts will be the designated Security OU. @@ -31 +28 @@ - * `BackupAdminBaseline` and `BackupCentralVaultBaseline` baselines can be disabled independently + * If member accounts move into the OU where the accounts for each integration reside, enabled controls on that OU are drifted regardless of whether auto-enrollment is turned on or off. @@ -33 +30 @@ - * `LogArchiveBaseline` can be disabled independently + * **Drift Notifications:** AWS Control Tower will stop sending drift notifications to SNS topic for all customers on landing zone 4.0 without the `AWSControlTowerBaseline` enabled, and will start sending drift notifications to EventBridge in the management account instead. To review sample events and guidance on how to receive drift notifications through EventBridge, please check [this guide](https://docs.aws.amazon.com/controltower/latest/userguide/governance-drift.html). @@ -35,77 +32 @@ - * **AWS Config and AWS CloudTrail now use separate dedicated S3 buckets and SNS topics** instead of shared resources. Customers have restricted flexibility to use a single or separate accounts for multiple integrations. - - * Data Location Changes: Existing customers upgrading from previously shared to dedicated resources will have AWS Config and AWS CloudTrail data in different S3 buckets. Established customer workflows and tools may need updates to access data from new bucket locations. - - * AWS CloudTrail will continue to stay in the same existing bucket, but AWS Config data will be in a new S3 bucket created by AWS Control Tower. - - * Customers can set-up cross-bucket replication if they wish to centralize different logs to a single bucket. Please see [ S3 documentation ](https://docs.aws.amazon.com//AmazonS3/latest/userguide/replication.html) for more information. - - * **New`ConfigBaseline` baseline: ** There is now a separate `ConfigBaseline` at the OU level for detective controls support without requiring the comprehensive `AWSControlTowerBaseline`. See list of [ baseline types at the OU level](https://docs.aws.amazon.com//controltower/latest/userguide/types-of-baselines.html#ou-baseline-types) for more information. For existing customers that are using the default landing zone, all service integrations are now optional, with the caveat of dependency requirements outlined above. - - * **Service-Linked Config Aggregator:** Replaces organization and account aggregators in the AWS Config central aggregator account. - - * When upgrading to landing zone 4.0 with AWS Config integration enabled, customers need to have `organizations:ListDelegatedAdministrators` permissions - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "backup:UpdateGlobalSettings", - "controltower:CreateLandingZone", - "controltower:UpdateLandingZone", - "controltower:ResetLandingZone", - "controltower:DeleteLandingZone", - "controltower:GetLandingZoneOperation", - "controltower:GetLandingZone", - "controltower:ListLandingZones", - "controltower:ListLandingZoneOperations", - "controltower:ListTagsForResource", - "controltower:TagResource", - "controltower:UntagResource", - "servicecatalog:*", - "organizations:*", - "organizations:RegisterDelegatedAdministrator", - "organizations:EnableAWSServiceAccess", - "organizations:DeregisterDelegatedAdministrator", - "organizations:ListDelegatedAdministrators", - "sso:*", - "sso-directory:*", - "logs:*", - "cloudformation:*", - "kms:*", - "iam:GetRole", - "iam:CreateRole", - "iam:GetSAMLProvider", - "iam:CreateSAMLProvider", - "iam:CreateServiceLinkedRole", - "iam:ListRolePolicies", - "iam:PutRolePolicy", - "iam:ListAttachedRolePolicies", - "iam:AttachRolePolicy", - "iam:DeleteRole", - "iam:DeleteRolePolicy", - "iam:DetachRolePolicy" - ], - "Resource": "*" - } - ] - } - - -When migrating to landing zone 4.0 with AWS Config integration enabled, customers would see the following changes - - - 1. The existing Audit account is registered as a delegated admin for AWS Config. - - 2. Service-Linked Config Aggregator is deployed into the Audit account (AWS Config central aggregator account for new customers and Audit account for existing customers). The new aggregator can aggregate data from any AWS Config Recorder in the organization, including non-Control Tower managed accounts. - - 3. Existing aggregators will be deleted - Organization aggregator in management account (` aws-controltower-ConfigAggregatorForOrganizations`) and account aggregator in Audit account (` aws-controltower-GuardRailsComplianceAggregator`) will be deleted. - - 4. Controls associated with the deleted aggregators will be automatically removed. Additionally, since AWS Config Rules and Configuration Aggregator will be service-linked resources, service control policy protection will no longer be required. - - 1. [Disallow Changes to Tags Created by AWS Control Tower for AWS Config Resources](https://docs.aws.amazon.com//controltower/latest/controlreference/mandatory-controls.html#cloudwatch-disallow-config-changes) - - 2. [Disallow Deletion of AWS Config Aggregation Authorizations Created by AWS Control Tower](https://docs.aws.amazon.com//controltower/latest/controlreference/mandatory-controls.html#config-aggregation-authorization-policy) - - 3. [Disallow Changes to AWS Config Rules Set Up by AWS Control Tower](https://docs.aws.amazon.com//controltower/latest/controlreference/mandatory-controls.html#config-rule-disallow-changes) + * **Optional Service Integrations:** You now have the ability to enable/disable all AWS Control Tower integrations including AWS Config, AWS CloudTrail, SecurityRoles, and AWS Backup. These integrations also now have optionally required `enabled` flags in the API. The baselines that may apply to your landing zone or shared accounts now have dependencies on one another. The Integrations specific dependencies are: @@ -113 +34 @@ When migrating to landing zone 4.0 with AWS Config integration enabled, customer - * **Optional Manifest:** Manifest field in the landing zone API is now optional. Customers can create Landing Zones without any service integrations. There is no impact for existing customers that are already using the manifest field. + * Enablement: @@ -115 +36 @@ When migrating to landing zone 4.0 with AWS Config integration enabled, customer - * **Optional Organization Structure:** AWS Control Tower no longer enforces or manages the Security OU creation so customers can define and manage their own organization structure. However, AWS Control Tower will require all accounts that are configured for each AWS service integration to be under the same parent OU. There is no impact for customers that have already set-up the AWS Control Tower and have the Security OU. + * `CentralSecurityRolesBaseline` → requires `CentralConfigBaseline` to be enabled @@ -117 +38 @@ When migrating to landing zone 4.0 with AWS Config integration enabled, customer -###### Note + * `IdentityCenterBaseline` → requires `CentralSecurityRolesBaseline` to be enabled @@ -119 +40 @@ When migrating to landing zone 4.0 with AWS Config integration enabled, customer -If member accounts move into the OU where the accounts for each integration reside, enabled controls on that OU are drifted regardless of whether auto-enrollment is turned on or off. + * `BackupCentralVaultBaseline` → requires `CentralSecurityRolesBaseline` to be enabled @@ -121 +42 @@ If member accounts move into the OU where the accounts for each integration resi - * **Drift Notifications:** AWS Control Tower will stop sending drift notifications to SNS topic for all customers on landing zone 4.0 without the `AWSControlTowerBaseline` enabled, and will start sending drift notifications to EventBridge in the management account instead. To review sample events and guidance on how to receive drift notifications through EventBridge, please check [this guide](https://docs.aws.amazon.com/controltower/latest/userguide/governance-drift.html). + * `BackupAdminBaseline` → requires `CentralSecurityRolesBaseline` to be enabled @@ -122,0 +44 @@ If member accounts move into the OU where the accounts for each integration resi + * `LogArchiveBaseline` → independent (no dependencies) @@ -123,0 +46 @@ If member accounts move into the OU where the accounts for each integration resi + * `CentralConfigBaseline` → independent (no dependencies) @@ -124,0 +48 @@ If member accounts move into the OU where the accounts for each integration resi + * Disablement: @@ -126 +50 @@ If member accounts move into the OU where the accounts for each integration resi -###### Note + * `CentralConfigBaseline` can only be disabled if `CentralSecurityRolesBaseline`, `IdentityCenterBaseline`, `BackupAdminBaseline` and `BackupCentralVaultBaseline` baselines are disabled first. @@ -128 +52 @@ If member accounts move into the OU where the accounts for each integration resi -###### Key Notes: + * `CentralSecurityRolesBaseline` can only be disabled if `IdentityCenterBaseline`, `BackupAdminBaseline` and `BackupCentralVaultBaseline` baselines are disabled first. @@ -130 +54 @@ If member accounts move into the OU where the accounts for each integration resi - * The definition of “registered” and “enrolled” have shifted with this new version of AWS Control Tower. When your account/OU has any AWS Control Tower resource enabled on it (e.g. control or baseline), it will be considered a governed resource. The definition will no longer be driven by the presence of the `AWSControlTowerBaseline` baseline. + * `IdentityCenterBaseline` can be disabled independently. @@ -132 +56 @@ If member accounts move into the OU where the accounts for each integration resi - * Service-Linked Roles are retained across all landing zone versions and are no longer deleted when OUs become "unregistered" + * `BackupAdminBaseline` and `BackupCentralVaultBaseline` baselines can be disabled independently @@ -134 +58 @@ If member accounts move into the OU where the accounts for each integration resi - * Service-Linked Roles can only be deleted manually by customers after landing zone decommissioning + * `LogArchiveBaseline` can be disabled independently @@ -147 +71 @@ Landing Zone v4.0 migration guide -Recommendations for setting up groups, roles, and policies +AWS Config Updates