AWS prescriptive-guidance documentation change
Summary
Fixed typo in heading ('acount' to 'account'), updated image path, formatted OU names in table as bold, and standardized apostrophe usage.
Security assessment
Changes involve typo corrections, image path updates, and formatting improvements. No security vulnerabilities, incidents, or weaknesses are addressed. The Suspended OU description about compromised accounts is existing content, not new security documentation.
Diff
diff --git a/prescriptive-guidance/latest/designing-control-tower-landing-zone/account-structure.md b/prescriptive-guidance/latest/designing-control-tower-landing-zone/account-structure.md index 00d3d8193..e06da3310 100644 --- a//prescriptive-guidance/latest/designing-control-tower-landing-zone/account-structure.md +++ b//prescriptive-guidance/latest/designing-control-tower-landing-zone/account-structure.md @@ -9 +9 @@ AWS Control Tower Account FactoryAWS Control Tower add-ons -# Configuring account structure and OUs +# Configuring acount structure and OUs @@ -13 +13 @@ You can achieve both speed and security in the cloud by using AWS accounts. AWS -One of the key principles of account structure design is to start with a basic structure and expand it as your needs evolve. For an example of an incremental approach for account structure design, see the section [Patterns for organizing your AWS accounts](https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/patterns-for-organizing-your-aws-accounts.html) in the AWS whitepaper _Organizing Your AWS Environment Using Multiple Accounts_. Your account structure might have to be tailored based on your industry. For examples, see the AWS blog post [Defining an AWS multi-account strategy for a digital bank](https://aws.amazon.com/blogs/industries/defining-an-aws-multi-account-strategy-for-a-digital-bank/) and the AWS Prescriptive Guidance guide [OU structure in regulated AWS landing zones: an example from the pharmaceutical industry](https://docs.aws.amazon.com/prescriptive-guidance/latest/ou-structure-landing-zone/introduction.html). Let’s look at some key considerations for OU design. +One of the key principles of account structure design is to start with a basic structure and expand it as your needs evolve. For an example of an incremental approach for account structure design, see the section [Patterns for organizing your AWS accounts](https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/patterns-for-organizing-your-aws-accounts.html) in the AWS whitepaper _Organizing Your AWS Environment Using Multiple Accounts_. Your account structure might have to be tailored based on your industry. For examples, see the AWS blog post [Defining an AWS multi-account strategy for a digital bank](https://aws.amazon.com/blogs/industries/defining-an-aws-multi-account-strategy-for-a-digital-bank/) and the AWS Prescriptive Guidance guide [OU structure in regulated AWS landing zones: an example from the pharmaceutical industry](https://docs.aws.amazon.com/prescriptive-guidance/latest/ou-structure-landing-zone/introduction.html). Let's look at some key considerations for OU design. @@ -26 +26 @@ The following diagram provides an example of an AWS Control Tower‒based accoun - + @@ -36 +36 @@ OU | Description -Security OU | Automatically set up by AWS Control Tower to host the Log Archive and Audit accounts. +**Security OU**| Automatically set up by AWS Control Tower to host the Log Archive and Audit accounts. @@ -42,2 +42,2 @@ Security OU | Automatically set up by AWS Control Tower to host the Log Archive -Sandbox OU | Set up by AWS Control Tower to host sandbox accounts that help you safely test and develop new services, processes, and templates. -Infrastructure OU | Contains the following accounts that are required for shared infrastructure services for your production and non-production workloads: +**Sandbox OU**| Set up by AWS Control Tower to host sandbox accounts that help you safely test and develop new services, processes, and templates. +**Infrastructure OU**| Contains the following accounts that are required for shared infrastructure services for your production and non-production workloads: @@ -53,7 +53,7 @@ For details of the recommended AWS services and the AWS solutions that you can h -Policy Staging OU | Helps you safely test policy changes such as detective and preventive controls before applying them to OUs or accounts. -Individual Business Users OU | Hosts accounts for individual business users and teams who want to internally use AWS resources that aren't classified as workloads. -Exceptions OU | Hosts accounts that require exceptions to the default security policies that are applied to the Workloads OU. -Workloads OU | Hosts business workloads for both production and non-production environments. -Deployments OU | Hosts resources for building, validating, and promoting releases to your environments. Includes continuous integration and continuous delivery (CI/CD) tooling. -Transitional OU | Provides a holding area for accounts that are being moved to the landing zone before formally integrating them into the standardized OUs in the account structure. -Suspended OU | Provides a locked and extremely restricted environment to host suspended, deleted, and reused accounts. This is useful if you suspect that an account has been breached or compromised. +**Policy Staging OU**| Helps you safely test policy changes such as detective and preventive controls before applying them to OUs or accounts. +**Individual Business Users OU**| Hosts accounts for individual business users and teams who want to internally use AWS resources that aren't classified as workloads. +**Exceptions OU**| Hosts accounts that require exceptions to the default security policies that are applied to the Workloads OU. +**Workloads OU**| Hosts business workloads for both production and non-production environments. +**Deployments OU**| Hosts resources for building, validating, and promoting releases to your environments. Includes continuous integration and continuous delivery (CI/CD) tooling. +**Transitional OU**| Provides a holding area for accounts that are being moved to the landing zone before formally integrating them into the standardized OUs in the account structure. +**Suspended OU**| Provides a locked and extremely restricted environment to host suspended, deleted, and reused accounts. This is useful if you suspect that an account has been breached or compromised.