AWS govcloud-us documentation change
Summary
Editorial updates to remove redundant references to AWS GovCloud (US) Regions throughout the document, shorten section headers, and consolidate account creation information.
Security assessment
Changes are purely editorial, removing repetitive mentions of 'AWS GovCloud (US) Regions' since the document already focuses on this environment. No security vulnerabilities, mitigations, or security feature enhancements are referenced. Modifications to terminology (e.g., 'not supported' → 'not available') are clarifications without security impact.
Diff
diff --git a/govcloud-us/latest/UserGuide/govcloud-controltower.md b/govcloud-us/latest/UserGuide/govcloud-controltower.md index d6a0460af..cc0266a9d 100644 --- a//govcloud-us/latest/UserGuide/govcloud-controltower.md +++ b//govcloud-us/latest/UserGuide/govcloud-controltower.md @@ -7 +7 @@ -How AWS Control Tower differs for AWS GovCloud (US)Creating your accountsInviting accounts to an organizationSetting up your landing zoneDocumentation for AWS Control TowerExport-controlled content +How AWS Control Tower differsCreating your accountsInviting accounts to an organizationSetting up your landing zoneDocumentationExport-controlled content @@ -15 +15 @@ You can utilize AWS Control Tower with workloads that require FedRAMP High categ -## How AWS Control Tower differs for AWS GovCloud (US) +## How AWS Control Tower differs @@ -17 +17 @@ You can utilize AWS Control Tower with workloads that require FedRAMP High categ -The following list details the differences for using this service in the AWS GovCloud (US) Regions compared to other AWS Regions: +The following differences apply to AWS Control Tower: @@ -21 +21 @@ The following list details the differences for using this service in the AWS Gov - * As in the commercial Region, you must use AWS Control Tower with all features enabled for AWS Organizations in AWS GovCloud (US) Regions. However, the consolidated billing feature set is not available in AWS GovCloud (US) Regions. + * As in the commercial Region, you must use AWS Control Tower with all features enabled for AWS Organizations in AWS GovCloud (US) Regions. However, the consolidated billing feature set is not available. @@ -29 +29 @@ The following list details the differences for using this service in the AWS Gov - * You start creating AWS GovCloud (US) accounts by calling the [CreateGovCloudAccount](https://docs.aws.amazon.com/organizations/latest/APIReference/API_CreateGovCloudAccount.html) action from the management account of the landing zone in the commercial Region. Calling account creation APIs from the AWS GovCloud (US) Regions is not supported. + * You start creating AWS GovCloud (US) accounts by calling the [CreateGovCloudAccount](https://docs.aws.amazon.com/organizations/latest/APIReference/API_CreateGovCloudAccount.html) action from the management account of the landing zone in the commercial Region. Calling account creation APIs from the AWS GovCloud (US) Regions is not available. @@ -56 +56 @@ AWS Control Tower in AWS GovCloud (US) requires you to bring your own, existing -The **Create account** feature in Account Factory is removed in AWS GovCloud (US) Regions. During the **Create account** workflow, you will see an error if the member account does not already exist in AWS GovCloud (US). +The **Create account** feature in Account Factory is removed in AWS GovCloud (US) Regions. During the **Create account** workflow, you will see an error if the member account does not already exist. @@ -64 +64 @@ You are redirected to the appropriate AWS GovCloud (US) home Region (AWS GovClou -An account in the commercial Region and the associated account in the AWS GovCloud (US) Region share an email adress. AWS Control Tower cannot verify account email addresses independently in AWS GovCloud (US) Regions. +An account in the commercial Region and the associated account in the AWS GovCloud (US) Region share an email adress. AWS Control Tower cannot verify account email addresses independently. @@ -84 +84 @@ Certain controls include functionality that has no effect in AWS GovCloud (US) R -The Marketplace link in the left navigation of the AWS Control Tower console is not available in AWS GovCloud (US) Regions. +The Marketplace link in the left navigation of the AWS Control Tower console is not available. @@ -88 +88 @@ The Marketplace link in the left navigation of the AWS Control Tower console is -Some controls in the Security Hub CSPM standard named **Service-Managed Standard: AWS Control Tower** are not supported in AWS GovCloud (US) Regions. For a complete list of these controls by Region, see [Security Hub CSPM](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-ash.html). +Some controls in the Security Hub CSPM standard named **Service-Managed Standard: AWS Control Tower** are not available in AWS GovCloud (US) Regions. For a complete list of these controls by Region, see [Security Hub CSPM](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-ash.html). @@ -92 +92 @@ Some controls in the Security Hub CSPM standard named **Service-Managed Standard - * **Resource control policy (RCP) controls** are not available in AWS GovCloud (US) Regions. + * **Resource control policy (RCP) controls** are not available. @@ -117,3 +117 @@ If your workload operates in AWS and AWS GovCloud (US) Regions, you may notice a -AWS Control Tower must be set up in the commercial Region before you can sign in to the AWS Control Tower management account to create AWS Control Tower accounts in AWS GovCloud (US). - -When you create an account in the AWS GovCloud (US) Regions from AWS Control Tower, an associated account in the commercial Region is created for billing and support purposes, automatically. The account in the commercial Region and the account in the AWS GovCloud (US) Regions are linked. +AWS Control Tower must be set up in the commercial Region before you can sign in to the AWS Control Tower management account to create AWS Control Tower accounts. When you create an account in the AWS GovCloud (US) Regions from AWS Control Tower, an associated account in the commercial Region is created for billing and support purposes, automatically. The account in the commercial Region and the account in the AWS GovCloud (US) Regions are linked. @@ -165 +163 @@ The following diagram shows how account access works, so that you can invite sta - * Sign into **AWS GovCloud (US) Account 1**. Assume the administrative role of the AWS GovCloud (US) account you just created in the AWS GovCloud (US) Regions. + * Sign into **AWS GovCloud (US) Account 1**. Assume the administrative role of the AWS GovCloud (US) account you just created. @@ -205 +203 @@ After you’ve performed these tasks, it’s a good idea to check the guardrails -## Documentation for AWS Control Tower +## Documentation