AWS controltower medium security documentation change
Summary
Added guidance to update AWS Config Delivery Channels' S3 bucket names to a Control Tower-managed bucket when enabling landing zone 4.0 CloudTrail integration
Security assessment
The change addresses potential security risks from misconfigured logging buckets. By requiring existing Config Delivery Channels to use Control Tower's managed S3 bucket (with specific security configurations), it prevents accidental exposure of configuration logs through non-compliant bucket settings. This mitigates risks of unauthorized access to sensitive logging data.
Diff
diff --git a/controltower/latest/userguide/config-updates-v4.md b/controltower/latest/userguide/config-updates-v4.md index cfcfa396d..bb26ff26a 100644 --- a//controltower/latest/userguide/config-updates-v4.md +++ b//controltower/latest/userguide/config-updates-v4.md @@ -20,0 +21,2 @@ Enabling AWS CloudTrail integration on landing zone 4.0 for the first time will + * If you have enrolled accounts with pre-existing AWS Config Delivery Channels not created by AWS Control Tower in Regions governed by AWS Control Tower, update the Delivery Channels' S3 bucket name to the new S3 bucket with prefix `aws-controltower-config-logs-` in the AWS Config integration account to be consistent with AWS Control Tower configurations on landing zone 4.0. See more details in [Enroll accounts that have existing AWS Config resources](./existing-config-resources.html). +