AWS controltower: Rename shared accounts to service integration accounts

Service: controltower · 2026-09-27 · Documentation low

File: controltower/latest/userguide/accounts.md

Summary

Updates terminology for security/logging accounts to Config aggregator/CloudTrail administrator and renames the 'About the shared accounts' heading to 'Service integration accounts'.

Security assessment

Purely a terminology/heading rename; no change to security behavior or guidance.

Evidence

-About the shared accounts

Diff

diff --git a/controltower/latest/userguide/accounts.md b/controltower/latest/userguide/accounts.md
index 63866092d..7f5e75845 100644
--- a//controltower/latest/userguide/accounts.md
+++ b//controltower/latest/userguide/accounts.md
@@ -42 +42 @@ New accounts in AWS Control Tower are created and then provisioned by an interac
-Before accepting an AWS account as a security (default name: **Audit**) or logging (default name: **Log archive**) account, AWS Control Tower checks the account for resources that conflict with AWS Control Tower requirements. For example, you may have a logging bucket with the same name that AWS Control Tower requires. Also, AWS Control Tower validates that the account can provision resources; for example, by ensuring that AWS Security Token Service (AWS STS) is enabled, that the account is not suspended, and that AWS Control Tower has permission to provision resources within the account.
+Before accepting an AWS account as a security (default name: **Config aggregator**) or logging (default name: **CloudTrail administrator**) account, AWS Control Tower checks the account for resources that conflict with AWS Control Tower requirements. For example, you may have a logging bucket with the same name that AWS Control Tower requires. Also, AWS Control Tower validates that the account can provision resources; for example, by ensuring that AWS Security Token Service (AWS STS) is enabled, that the account is not suspended, and that AWS Control Tower has permission to provision resources within the account.
@@ -65 +65 @@ Configure the Region deny control
-About the shared accounts
+Service integration accounts