AWS controltower documentation change
Summary
Updated version references from '4.0' to 'landing zone 4.0' for clarity, and refined descriptions of control changes in AWS Control Tower 4.0 including Config/CloudTrail updates and deprecated controls
Security assessment
Changes are administrative updates clarifying version-specific behavior of security controls. No evidence of vulnerability fixes; updates describe lifecycle changes of existing controls without new security content.
Diff
diff --git a/controltower/latest/controlreference/mandatory-controls.md b/controltower/latest/controlreference/mandatory-controls.md index 258ae1110..bc147e249 100644 --- a//controltower/latest/controlreference/mandatory-controls.md +++ b//controltower/latest/controlreference/mandatory-controls.md @@ -9 +9 @@ Changes in Landing Zone 4.0 controlsMandatory controls for the Security OUMandat -Mandatory controls are owned by AWS Control Tower, and they apply to every OU on your landing zone, with some exceptions for the **Security OU**. These controls are applied to your OUs by default when you set up your , and they can't be deactivated, because they protect AWS Control Tower resources. +Mandatory controls are owned by AWS Control Tower, and they apply to every OU on your landing zone, with some exceptions for the **Security OU**. These controls are applied to your OUs by default when you set up your landing zone, and they can't be deactivated, because they protect AWS Control Tower resources. @@ -26 +26 @@ Following, you'll find a reference for each of the mandatory controls available - * AWS Control Tower will no longer deploy the below controls from 4.0 because these protect the account trails which were deployed in 2.9 and below. These controls would still be applied for versions below 4.0 and would be deleted once customers upgrade to versions 4.0 and above. + * AWS Control Tower will no longer deploy the below controls from landing zone 4.0 because these protect the account trails which were deployed in landing zone 2.9 and below. These controls would still be applied for landing zone versions below 4.0 and would be deleted once customers upgrade to versions 4.0 and above. @@ -40 +40 @@ Following, you'll find a reference for each of the mandatory controls available - * The following controls will be removed if the customer has AWS Config integration enabled and are upgrading to 4.0 and above (Note: Customers on versions below 4.0 have AWS Config integration enabled by default). These controls are related to legacy AWS Config aggregators and are no longer required for Service-Linked Config Aggregator. Read more on the Service-linked Config aggregator [here](https://docs.aws.amazon.com//prescriptive-guidance/latest/designing-control-tower-landing-zone/config-mgmt). + * The following controls will be removed if the customer has AWS Config integration enabled and are upgrading to landing zone 4.0 and above (Note: Customers on landing zone versions below 4.0 have AWS Config integration enabled by default). These controls are related to legacy AWS Config aggregators and are no longer required for Service-Linked Config Aggregator. Read more on the Service-linked Config aggregator [here](https://docs.aws.amazon.com//prescriptive-guidance/latest/designing-control-tower-landing-zone/config-mgmt). @@ -48 +48 @@ Following, you'll find a reference for each of the mandatory controls available - * The AWS CloudTrail integration tied to the manifest `centralizedLogging` configuration has two new controls starting 4.0 + * The AWS CloudTrail integration tied to the manifest `centralizedLogging` configuration has two new controls starting landing zone 4.0 @@ -124 +124 @@ Following, you'll find a reference for each of the mandatory controls available - * The AWS Config integration has a new control starting 4.0 + * The AWS Config integration has a new control starting landing zone 4.0 @@ -164 +164 @@ Following, you'll find a reference for each of the mandatory controls available - * On 4.0, AWS Control Tower will disable the following controls as they are replaced with a single unified preventive control for AWS Config integration. The security governance boundary remains the same, but with reduced SCP space. + * On landing zone 4.0, AWS Control Tower will disable the following controls as they are replaced with a single unified preventive control for AWS Config integration. The security governance boundary remains the same, but with reduced SCP space. @@ -180 +180 @@ Following, you'll find a reference for each of the mandatory controls available - * AWS Control Tower is updating the following controls for all versions, this change will take place when customers update/reset their existing setup. + * AWS Control Tower is updating the following controls for all landing zone versions, this change will take place when customers update/reset their existing setup.