AWS controltower documentation change
Summary
Clarified account provisioning limits by distinguishing between scenarios with auto-enrollment disabled (up to 5 accounts simultaneously) and enabled (same limit, but provisioning is blocked if an account move operation is active on the destination OU).
Security assessment
This change provides operational guidance on provisioning limits and blocking conditions in AWS Control Tower. There is no evidence of a security issue, vulnerability, or incident being addressed. The update is purely administrative, clarifying behavior under different configurations without introducing security features or addressing security concerns.
Diff
diff --git a/controltower/latest/userguide/af-guidance.md b/controltower/latest/userguide/af-guidance.md index 7b363f0de..156f59a5b 100644 --- a//controltower/latest/userguide/af-guidance.md +++ b//controltower/latest/userguide/af-guidance.md @@ -19 +19,3 @@ If you're authenticated as an IAM user or IAM Identity Center user when provisio -Up to five accounts can be provisioned at a time. +**With auto-enrollment disabled:** Up to five accounts can be provisioned simultaneously. + +**With auto-enrollment enabled:** Up to 5 accounts can be provisioned simultaneously, but any active account move operation for the destination OU blocks all provisioning on the same OU until it completes.