AWS controltower documentation change
Summary
Updated AWS Config logging destination details and added version-specific bucket locations
Security assessment
The change clarifies where AWS Config logs are stored across different landing zone versions. While this improves documentation of a security feature (centralized log storage), there's no evidence of a specific security vulnerability being addressed. The update enhances transparency about security architecture but doesn't resolve a concrete security issue.
Diff
diff --git a/controltower/latest/userguide/monitoring-with-config.md b/controltower/latest/userguide/monitoring-with-config.md index 961c10706..a01a6b5f7 100644 --- a//controltower/latest/userguide/monitoring-with-config.md +++ b//controltower/latest/userguide/monitoring-with-config.md @@ -11 +11 @@ View the AWS Config recorder data on enrolled accountsTroubleshooting AWS Config -AWS Control Tower enables AWS Config on all enrolled accounts, so that it can monitor compliance through detective controls, record resource changes, and deliver resource change logs to the log archive account. +AWS Control Tower enables AWS Config on all enrolled accounts, so that it can monitor compliance through detective controls, record resource changes, and deliver resource change logs to a centralized account. @@ -26 +26,8 @@ AWS Control Tower enables AWS Config on all enrolled accounts, so that it can mo -AWS Control Tower sets up an AWS Config delivery channel in all enrolled accounts. Through this delivery channel, it logs all changes recorded by AWS Config in the log archive account, where they are stored to a folder in an Amazon Simple Storage Service bucket. +AWS Control Tower sets up an AWS Config delivery channel in all enrolled accounts. Through this delivery channel, it logs all recorded changes in a centralized account, where they are stored in an Amazon Simple Storage Service bucket. The name and location of the Amazon S3 bucket depend on your landing zone version: + + * For landing zone version 3.3 or earlier, the logs are stored in the `aws-controltower-logs-*` Amazon S3 bucket in the log archive account. + + * For landing zone version 4.0 or later, the logs are stored in the `aws-controltower-config-logs-*` Amazon S3 bucket in the AWS Config integration account (previously known as the Audit account). For more information, see [AWS Config Updates](./config-updates-v4.html). + + +