AWS controltower documentation change
Summary
Updated documentation to clarify that AWS Service Catalog APIs can be used for both provisioning new accounts and enrolling existing member accounts, and added a note about the AWSControlTowerExecution IAM role requirement for existing account enrollment.
Security assessment
The change adds documentation about a security requirement (the AWSControlTowerExecution IAM role must exist) for enrolling existing accounts via API. This is a security best practice documentation update that clarifies prerequisites for secure account enrollment, but there's no evidence it addresses a specific security vulnerability.
Diff
diff --git a/controltower/latest/userguide/automated-provisioning-walkthrough.md b/controltower/latest/userguide/automated-provisioning-walkthrough.md index 204cc3fa3..8f506a9ff 100644 --- a//controltower/latest/userguide/automated-provisioning-walkthrough.md +++ b//controltower/latest/userguide/automated-provisioning-walkthrough.md @@ -9 +9 @@ Sample provisioning input for Service Catalog APIVideo Walkthrough -AWS Control Tower is integrated with several other AWS services, such as AWS Service Catalog. You can use the APIs to create and provision your member accounts in AWS Control Tower. +AWS Control Tower is integrated with several other AWS services, such as AWS Service Catalog. You can use the APIs to create and provision your member accounts in AWS Control Tower, or to enroll existing member accounts. @@ -105 +105,5 @@ After configuring these roles, you call the AWS Service Catalog APIs to perform -Here is a sample of the input you can give to the Service Catalog `ProvisionProduct` API if you're using the API to provision AWS Control Tower accounts: +Here is a sample of the input you can give to the Service Catalog `ProvisionProduct` API if you're using the API to provision new AWS Control Tower accounts or to enroll existing member accounts: + +###### Note + +To enroll an existing member account using the `ProvisionProduct` API, the `AWSControlTowerExecution` IAM role must exist on the target account before you call the API. You can use the same input parameters shown in the following example for both new account provisioning and existing account enrollment.