AWS prescriptive-guidance documentation change
Summary
Updated terminology for IAM Identity Center, restructured bullet points into numbered list, removed service quota requirement, added guardrail application note, corrected formatting for stack set names, updated Service Catalog references, added documentation links, and revised section headings.
Security assessment
Changes are editorial updates (terminology, formatting, restructuring) without evidence of addressing security vulnerabilities. References to guardrails are existing security features documentation, not new additions. No CVE, vulnerability fix, or incident response mentioned.
Diff
diff --git a/prescriptive-guidance/latest/aws-control-tower/deploy.md b/prescriptive-guidance/latest/aws-control-tower/deploy.md index 6dbfbb8cc..1501118c4 100644 --- a//prescriptive-guidance/latest/aws-control-tower/deploy.md +++ b//prescriptive-guidance/latest/aws-control-tower/deploy.md @@ -15 +15 @@ This scenario details the steps involved in deploying AWS Control Tower in an AW - 2. If you are currently using AWS IAM Identity Center, deploy AWS Control Tower in the same AWS Region where IAM Identity Center is configured. + 2. If you are currently using AWS IAM Identity Center (successor to AWS Single Sign-On), deploy AWS Control Tower in the same AWS Region where IAM Identity Center is configured. @@ -26 +26 @@ Here's what to expect when you set up your AWS Control Tower landing zone in an - * You can have one landing zone in each AWS Organizations organization. + 1. You can have one landing zone in each AWS Organizations organization. @@ -28 +28 @@ Here's what to expect when you set up your AWS Control Tower landing zone in an - * AWS Control Tower uses the management account from your existing AWS Organizations organization as its management account. No new management account is needed. + 2. AWS Control Tower uses the management account from your existing AWS Organizations organization as its management account. No new management account is needed. @@ -30 +30 @@ Here's what to expect when you set up your AWS Control Tower landing zone in an - * AWS Control Tower sets up two new accounts in a registered Security OU: an audit account and a log archive account, unless you are using existing accounts during setup. If you are using existing accounts, AWS Control Tower will move the audit and log archive accounts under the OU that you created during AWS Control Tower deployment. + 3. AWS Control Tower sets up two new accounts in a registered Security OU: an audit account and a log archive account, unless you are using existing accounts during setup. If you are using existing accounts, AWS Control Tower will move the audit and log archive accounts under the OU that you created during AWS Control Tower deployment. @@ -32 +32 @@ Here's what to expect when you set up your AWS Control Tower landing zone in an - * Your organization's service quotas must be adequate for the creation of these two additional accounts. + 4. After launch, AWS Control Tower guardrails apply automatically to accounts in that OU. @@ -34,3 +34 @@ Here's what to expect when you set up your AWS Control Tower landing zone in an - * After launch, AWS Control Tower guardrails apply automatically to accounts in that OU. - - * You can enroll additional existing AWS accounts into an OU that's governed by AWS Control Tower, so that guardrails apply to those accounts. + 5. You can enroll additional existing AWS accounts into an OU that's governed by AWS Control Tower, so that guardrails apply to those accounts. @@ -45 +43 @@ If you want to enroll any existing AWS accounts or OUs into AWS Control Tower af -You can extend AWS Control Tower governance to an individual, existing AWS account when you _enroll_ it into an organizational unit (OU) that's already governed by AWS Control Tower. Eligible accounts exist in _unregistered OUs_ that are part of the same AWS Organizations organization as the AWS Control Tower OU. +You can extend AWS Control Tower governance to an individual, existing AWS account when you _enroll_ it into an organizational unit (OU) that's already governed by AWS Control Tower. Eligible accounts exist in _unregistered OUs that are part of the same AWS Organizations organization_ as the AWS Control Tower OU. @@ -51 +49 @@ We recommend registering an OU, instead of enrolling individual accounts. The be -Before you enroll AWS accounts with AWS Control Tower, delete the AWS CloudFormation stack instances from the stack set named `AWS-Landing-Zone-Baseline-EnableConfig`. In each account that you want to enroll, in every AWS Region where AWS Control Tower is deployed, you must delete `AWS-Landing-Zone-Baseline-EnableConfig` stack instance. Because deleting the complete stack set takes time, we recommend deleting the stack instances only for the accounts that you are enrolling. Ideally, deleting the stack instances for a specific account should result in deleting the AWS Config recorder and delivery channel. You can verify the deletion by running the following commands for that account. +Before you enroll AWS accounts with AWS Control Tower, delete the AWS CloudFormation stack instances from the stack set named AWS-Landing-Zone-Baseline-EnableConfig. In each account that you want to enroll, in every AWS Region where AWS Control Tower is deployed, you must delete AWS-Landing-Zone-Baseline-EnableConfig stack instance. Because deleting the complete stack set takes time, we recommend deleting the stack instances only for the accounts that you are enrolling. Ideally, deleting the stack instances for a specific account should result in deleting the AWS Config recorder and delivery channel. You can verify the deletion by running the following commands for that account. @@ -69 +66 @@ For more information, see [Register an existing organizational unit with AWS Con -After an account is enrolled in AWS Control Tower, you will see another provisioned product in Service Catalog for the account that you enrolled. The name of the provisioned product will be prefixed with **Enroll-**. This means that you now have two provisioned products in Service Catalog for a single account: +After an account is enrolled in AWS Control Tower, you will see another provisioned product in AWS Service Catalog for the account that you enrolled. The name of the provisioned product will be prefixed with **Enroll-**. This means that you now have two provisioned products in AWS Service Catalog for a single account: @@ -80 +77 @@ You have an option to terminate the provisioned product for an account from AWS -When you terminate the provisioned product for accounts vended in AWS Landing Zone environment, the `Terminate` operation will start deleting the associated baseline CloudFormation stack sets, which you might want to retain. Be sure to assess the baseline stack sets in manifest.yaml, and understand the implications of deleting the stack sets. If you have any resources in the stack sets that you want to retain, avoid deleting the provisioned product. A partial deletion will render the provisioned product in the **Tainted** state in the Service Catalog console. +When you terminate the provisioned product for accounts vended in AWS Landing Zone environment, the Terminate operation will start deleting the associated baseline CloudFormation stack sets, which you might want to retain. Be sure to assess the baseline stack sets in manifest.yaml, and understand the implications of deleting the stack sets. If you have any resources in the stack sets that you want to retain, avoid deleting the provisioned product. A partial deletion will render the provisioned product in the **Tainted** state in the AWS Service Catalog console. @@ -90 +87 @@ You might want to deploy AWS Control Tower in a new AWS Organizations organizati - 2. Deploy AWS Control Tower in the newly created account. + 2. [Deploy AWS Control Tower](https://docs.aws.amazon.com/controltower/latest/userguide/getting-started-with-control-tower.html) in the newly created account. @@ -92 +89 @@ You might want to deploy AWS Control Tower in a new AWS Organizations organizati - 3. To migrate an AWS account from an existing organization to the new organization where you deployed AWS Control Tower, see the [instructions](https://aws.amazon.com/premiumsupport/knowledge-center/organizations-move-accounts/). It’s important to review and understand all the account access, billing, licensing, and tax considerations that are covered. + 3. To migrate an AWS account from an existing organization to the new organization where you deployed AWS Control Tower, see the [instructions](https://aws.amazon.com/premiumsupport/knowledge-center/organizations-move-accounts/). It's important to review and understand all the account access, billing, licensing, and tax considerations that are covered. @@ -96 +93 @@ You might want to deploy AWS Control Tower in a new AWS Organizations organizati - 5. Start enrolling the AWS account in AWS Control Tower. To perform the enrollment, see the section Enrolling existing AWS accounts with AWS Control Tower in an existing organization. + 5. Start enrolling the AWS account in AWS Control Tower. To perform the enrollment, see the section Enrolling existing AWS accounts into AWS Control Tower. @@ -109 +106 @@ Prerequisites -Customizations solution +Deploying the Customizations for AWS Control Tower solution