AWS controltower documentation change

Service: controltower · 2026-06-10 · Documentation low

File: controltower/latest/userguide/account-factory-considerations.md

Summary

Updated resource list with version-specific deployment notes and added AWS Config resources

Security assessment

Changes reflect product updates without addressing security vulnerabilities or adding security documentation.

Diff

diff --git a/controltower/latest/userguide/account-factory-considerations.md b/controltower/latest/userguide/account-factory-considerations.md
index 4db2eeba2..a05dd68ae 100644
--- a//controltower/latest/userguide/account-factory-considerations.md
+++ b//controltower/latest/userguide/account-factory-considerations.md
@@ -13 +13 @@ AWS service | Resource type | Resource name
-AWS CloudFormation | Stacks |  StackSet-AWSControlTowerBP-BASELINE-CLOUDTRAIL-* StackSet-AWSControlTowerBP-BASELINE-CLOUDWATCH-* StackSet-AWSControlTowerBP-BASELINE-CONFIG-* StackSet-AWSControlTowerBP-BASELINE-ROLES-* StackSet-AWSControlTowerBP-BASELINE-SERVICE-ROLES-*  
+AWS CloudFormation | Stacks |  StackSet-AWSControlTowerBP-BASELINE-CLOUDTRAIL-* (Not deployed in landing zone version 3.0 and later) StackSet-AWSControlTowerBP-BASELINE-CLOUDWATCH-* StackSet-AWSControlTowerBP-BASELINE-CONFIG-* StackSet-AWSControlTowerBP-BASELINE-ROLES-* StackSet-AWSControlTowerBP-BASELINE-SERVICE-ROLES-*  
@@ -15,3 +15,4 @@ AWS CloudTrail | Trail | aws-controltower-BaselineCloudTrail
-Amazon CloudWatch | CloudWatch Event Rules | aws-controltower-ConfigComplianceChangeEventRule  
-Amazon CloudWatch | CloudWatch Logs | aws-controltower/CloudTrailLogs /aws/lambda/aws-controltower-NotificationForwarder  
-AWS Identity and Access Management | Roles | aws-controltower-AdministratorExecutionRole aws-controltower-CloudWatchLogsRole aws-controltower-ConfigRecorderRole aws-controltower-ForwardSnsNotificationRole aws-controltower-ReadOnlyExecutionRole AWSControlTowerExecution  
+AWS Config | Delivery channel | aws-controltower-BaselineConfigDeliveryChannel  
+AWS Config | Recorder | aws-controltower-BaselineConfigRecorder  
+Amazon CloudWatch | CloudWatch Logs |  /aws/lambda/aws-controltower-NotificationForwarder  
+AWS Identity and Access Management | Roles | aws-controltower-AdministratorExecutionRole aws-controltower-CloudWatchLogsRole (Not deployed in landing zone version 3.0 and later) aws-controltower-ConfigRecorderRole (Not deployed in landing zone version 2.8 and later) aws-controltower-ForwardSnsNotificationRole aws-controltower-ReadOnlyExecutionRole AWSControlTowerExecution