AWS controltower documentation change
Summary
Updated documentation for enrolling accounts with existing AWS Config resources into AWS Control Tower. Changes include: revised step descriptions, restructured limitations/assumptions sections, added version-specific instructions for landing zones, removed outdated notes, and clarified bucket references.
Security assessment
The changes are procedural updates for account enrollment workflows. No evidence of addressing a specific security vulnerability or incident exists. Modifications focus on version compatibility (v3.3 vs v4.0+), support limitations, and workflow clarifications without introducing new security features or addressing security flaws.
Diff
diff --git a/controltower/latest/userguide/existing-config-resources.md b/controltower/latest/userguide/existing-config-resources.md index 15eb02756..0578c7c73 100644 --- a//controltower/latest/userguide/existing-config-resources.md +++ b//controltower/latest/userguide/existing-config-resources.md @@ -5 +5 @@ -Step 1: Contact customer support with a ticket, to add the account to the AWS Control Tower allow listStep 2: Create a new IAM role in the member account Step 3: Identify the AWS Regions with pre-existing resources Step 4: Identify the AWS Regions without any AWS Config resourcesStep 5: Modify the existing resources in each AWS RegionStep 5a. AWS Config recorder resourcesStep 5b. Modify AWS Config delivery channel resources Step 5c. Modify AWS Config aggregation authorization resourcesStep 6: Create resources where they don’t exist, in Regions governed by AWS Control Tower Step 7: Register the OU with AWS Control Tower +Step 1: Contact support to add account(s) to the allow listStep 2: Create a new IAM role in the member account Step 3: Identify the AWS Regions with pre-existing resources Step 4: Identify the AWS Regions without any AWS Config resourcesStep 5: Modify the existing resources in each AWS RegionStep 5a. AWS Config recorder resourcesStep 5b. Modify AWS Config delivery channel resources Step 5c. Modify AWS Config aggregation authorization resourcesStep 6: Create resources where they don’t exist, in Regions governed by AWS Control Tower Step 7: Register the OU with AWS Control Tower @@ -11,4 +10,0 @@ This topic provides a step-by-step approach for how to enroll accounts that have -###### Note - -If you plan to bring existing AWS accounts into AWS Control Tower as **Audit** and **Log archive** accounts, and if those accounts have existing AWS Config resources, you must delete the existing AWS Config resources completely, before you can enroll these accounts into AWS Control Tower for this purpose. For accounts that are not intended to become **Audit** and **Log archive** accounts, you can modify the existing Config resources. - @@ -28,5 +24 @@ Here are some types of AWS Config resources that your account could have already -###### Assumptions - - * You have deployed an AWS Control Tower landing zone - - * Your account is not enrolled with AWS Control Tower already. +###### Limitations @@ -34 +26 @@ Here are some types of AWS Config resources that your account could have already - * Your account has at least one pre-existing AWS Config resource in at least one of the AWS Control Tower Regions governed by the management account. + * Enroll account with existing AWS Config resource is not supported for management account or service integration account(s) configured in landing zone. @@ -36 +28 @@ Here are some types of AWS Config resources that your account could have already - * Your account is not the AWS Control Tower management account. + * The account can be enrolled only by using the OU registration or re-registration workflow which enables the `AWSControlTowerBaseline`. The account can not be enrolled by enabling or resetting the `ConfigBaseline`. @@ -38 +30 @@ Here are some types of AWS Config resources that your account could have already - * Your account is not in governance drift. + * Account with existing AWS Config resource is not supported by [Move and enroll accounts with auto-enrollment](./account-auto-enrollment.html). @@ -39,0 +32 @@ Here are some types of AWS Config resources that your account could have already + * If the resources are modified and create drift on the account, AWS Control Tower does not update the resources. @@ -40,0 +34 @@ Here are some types of AWS Config resources that your account could have already + * AWS Config resources in Regions that are not governed by AWS Control Tower are not changed. @@ -43 +36,0 @@ Here are some types of AWS Config resources that your account could have already -For a blog that describes an automated approach to enrolling accounts with existing AWS Config resources, see [Automate enrollment of accounts with existing AWS Config resources into AWS Control Tower](https://aws.amazon.com//blogs/mt/automate-enrollment-of-accounts-with-existing-aws-config-resources-into-aws-control-tower/). You'll be able to submit a single support ticket for all of the accounts you wish to enroll, as described in Step 1: Contact customer support with a ticket, to add the account to the AWS Control Tower allow list, which follows. @@ -45 +37,0 @@ For a blog that describes an automated approach to enrolling accounts with exist -###### Note @@ -47 +39 @@ For a blog that describes an automated approach to enrolling accounts with exist -If you've enabed auto-enroll for accounts (in the **Settings** page), you will not be able to enroll accounts with existing AWS Config resources automatically. +###### Assumptions @@ -49 +41 @@ If you've enabed auto-enroll for accounts (in the **Settings** page), you will n -###### Limitations + * You have deployed an AWS Control Tower landing zone. @@ -51 +43 @@ If you've enabed auto-enroll for accounts (in the **Settings** page), you will n - * The account can be enrolled only by using the OU registration or re-registration workflow which enables the `AWSControlTowerBaseline`. The account can not be enrolled by enabling or resetting the `ConfigBaseline`. + * Your account is not enrolled with AWS Control Tower already. @@ -53 +45 @@ If you've enabed auto-enroll for accounts (in the **Settings** page), you will n - * If the resources are modified and create drift on the account, AWS Control Tower does not update the resources. + * Your account has at least one pre-existing AWS Config resource in at least one of the Regions governed by AWS Control Tower. @@ -55 +47 @@ If you've enabed auto-enroll for accounts (in the **Settings** page), you will n - * AWS Config resources in Regions that are not governed by AWS Control Tower are not changed. + * Your account is not in governance drift. @@ -63,0 +56,2 @@ If you attempt to enroll an account that has existing Config resources, without +For a blog that describes an automated approach to enrolling accounts with existing AWS Config resources, see [Automate enrollment of accounts with existing AWS Config resources into AWS Control Tower](https://aws.amazon.com//blogs/mt/automate-enrollment-of-accounts-with-existing-aws-config-resources-into-aws-control-tower/). + @@ -66 +60 @@ If you attempt to enroll an account that has existing Config resources, without - 1. Add the account to the AWS Control Tower allow list. + 1. Add the account(s) to the AWS Control Tower allow list. @@ -90 +84 @@ If you attempt to enroll an account that has existing Config resources, without -## Step 1: Contact customer support with a ticket, to add the account to the AWS Control Tower allow list +## Step 1: Contact support to add account(s) to the allow list @@ -100 +94 @@ _Enroll accounts that have existing AWS Config resources into AWS Control Tower_ - * Account numbers of member accounts that have existing AWS Config resources + * Account numbers of member accounts that have existing AWS Config resources. You'll be able to create a support case for all of the accounts you wish to enroll. @@ -165 +159,5 @@ For this step, the following information is needed about your AWS Control Tower - * `LOGGING_ACCOUNT` \- the Logging account ID + * `AUDIT_ACCOUNT` \- the AWS Config service integration account (previously known as the Audit account) ID + + * `CONFIG_BUCKET` \- the AWS S3 bucket to which AWS Config delivers configuration snapshots and configuration history files. Locate and confirm that the AWS S3 bucket exists before proceeding to the next steps. + + * For landing zone version 3.3 or lower, the AWS S3 bucket is named `aws-controltower-logs-LOGGING_ACCOUNT-HOME_REGION`, located in the Logging account. @@ -167 +165 @@ For this step, the following information is needed about your AWS Control Tower - * `AUDIT_ACCOUNT` \- the Audit account ID + * For landing zone version 4.0 or higher, the AWS S3 bucket is named `aws-controltower-config-logs-AUDIT_ACCOUNT-<REGION_STRING>-<SUFFIX_STRING>`, located in the AWS Config service integration account (previously known as the Audit account). @@ -169 +167 @@ For this step, the following information is needed about your AWS Control Tower - * `IAM_ROLE_ARN` \- the IAM role ARN created in Step 1 + * `IAM_ROLE_ARN` \- the IAM role ARN created in Step 2 @@ -215,3 +213 @@ Only one AWS Config delivery channel can exist per Region. If another exists, mo - * **S3BucketName:** The logging bucket name from the AWS Control Tower logging account - -`aws-controltower-logs-`LOGGING_ACCOUNT`-`HOME_REGION`` + * **S3BucketName:**`CONFIG_BUCKET` @@ -231 +227 @@ This modification can be made through the AWS CLI using the following command. R - aws configservice put-delivery-channel --delivery-channel name=DELIVERY_CHANNEL_NAME,s3BucketName=aws-controltower-logs-LOGGING_ACCOUNT_ID-HOME_REGION,s3KeyPrefix="ORGANIZATION_ID",configSnapshotDeliveryProperties={deliveryFrequency=TwentyFour_Hours},snsTopicARN=arn:aws:sns:CURRENT_REGION:AUDIT_ACCOUNT:aws-controltower-AllConfigNotifications --region CURRENT_REGION + aws configservice put-delivery-channel --delivery-channel name=DELIVERY_CHANNEL_NAME,s3BucketName=CONFIG_BUCKET,s3KeyPrefix="ORGANIZATION_ID",configSnapshotDeliveryProperties={deliveryFrequency=TwentyFour_Hours},snsTopicARN=arn:aws:sns:CURRENT_REGION:AUDIT_ACCOUNT:aws-controltower-AllConfigNotifications --region CURRENT_REGION @@ -235,0 +232,4 @@ This modification can be made through the AWS CLI using the following command. R +###### Note + +This step is not required for landing zone version 4.0 or higher. + @@ -260,0 +261,4 @@ Replace the item `GLOBAL_RESOURCE_RECORDING` with **true** in your home Region. +###### Note + +The `CustomerCreatedAggregationAuthorization` resource in the template is not required for landing zone version 4.0 or higher. + @@ -279 +283 @@ Replace the item `GLOBAL_RESOURCE_RECORDING` with **true** in your home Region. - S3BucketName: aws-controltower-logs-LOGGING_ACCOUNT-HOME_REGION + S3BucketName: CONFIG_BUCKET @@ -291 +295 @@ Replace the item `GLOBAL_RESOURCE_RECORDING` with **true** in your home Region. - 1. In the **S3BucketName** field, replace the `LOGGING_ACCOUNT_ID` and `HOME_REGION` + 1. In the **S3BucketName** field, replace the `CONFIG_BUCKET`