AWS controltower: Restructure multi-account OU guidance and update whitepaper links
Summary
Replaces the 'Example of AWS Control Tower with a complete multi-account OU structure' section with 'Align your OU structure with the AWS multi-account strategy', removes detailed example OU descriptions, and updates whitepaper links.
Security assessment
This is a documentation reorganization of multi-account OU guidance and link updates; no security control, credential, or vulnerability content is introduced or fixed.
Evidence
+## Align your OU structure with the AWS multi-account strategy
Diff
diff --git a/controltower/latest/userguide/aws-multi-account-landing-zone.md b/controltower/latest/userguide/aws-multi-account-landing-zone.md index 7b7efd15f..dc2a5f42e 100644 --- a//controltower/latest/userguide/aws-multi-account-landing-zone.md +++ b//controltower/latest/userguide/aws-multi-account-landing-zone.md @@ -7 +7 @@ -Align with AWS multi-account guidanceGuidelines to set up a well-architected environmentExample of AWS Control Tower with a complete multi-account OU structureAbout the Root +Align with AWS multi-account guidanceGuidelines to set up a well-architected environmentAlign your OU structure with the AWS multi-account strategyAbout the Root @@ -133 +133 @@ AWS Control Tower does not set up the Workloads OU for you. -For more information see [Production starter organization with AWS Control Tower](https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/production-starter-organization.html#production-starter-organization-with-aws-control-tower). +For more information see [How AWS Control Tower establishes your multi-account environment](https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/how-does-aws-control-tower-establish-your-multi-account-environment.html). @@ -135 +135 @@ For more information see [Production starter organization with AWS Control Tower -## Example of AWS Control Tower with a complete multi-account OU structure +## Align your OU structure with the AWS multi-account strategy @@ -139,31 +139 @@ AWS Control Tower supports a nested OU hierarchy, which means that you can creat -You also can build a simpler, flat OU structure that performs well and aligns with the AWS multi-account guidance. Just because you can build a hierarchical OU structure, it does not mean that you must do so. - - * To view a diagram that shows an example set of OUs in an expanded, flat AWS Control Tower environment with AWS multi-account guidance, see [ Example: Workloads in a Flat OU Structure](https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/appendix-e-establish-multi-account.html#example-workloads-flat-structure). - - * For more information about how AWS Control Tower works with nested OU structures, see [Nested OUs in AWS Control Tower](./nested-ous.html). - - * For more information about how AWS Control Tower aligns with the AWS guidance, see the AWS white paper, [Organizing Your AWS Environment Using Multiple Accounts](https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/appendix-e-establish-multi-account.html). - - - - -The diagram on the linked page shows that more Foundational OUs and more Additional OUs have been created. These OUs serve the additional needs of a larger deployment. - -In the Foundational OUs column, two OUs have been added to the basic structure: - - * **Security_Prod OU** – Provides a read-only area for security policies, as well as a break-glass security audit area. - - * **Infrastructure OU** – You may wish to separate the Infrastructure OU, recommended previously, into two OUs, Infrastructure_Test (for pre-production infrastructure) and Infrastructure_Prod (for production infrastructure). - - - - -In the Additional OUs area, several more OUs have been added to the basic structure. These following are the next recommended OUs to create as your environment grows: - - * **Workloads OU** – The Workloads OU, recommended previously but optional, has been separated into two OUs, Workloads_Test (for pre-production workloads) and Workloads_Prod (for production workloads). - - * **PolicyStaging OU** – Allows system administrators to test their changes to controls and policies before fully applying them. - - * **Suspended OU** – Offers a location for accounts that may have been disabled temporarily. - - +For more information about how AWS Control Tower works with nested OU structures, see [Nested OUs in AWS Control Tower](./nested-ous.html). @@ -170,0 +141 @@ In the Additional OUs area, several more OUs have been added to the basic struct +For recommended OUs and accounts beyond the ones AWS Control Tower sets up by default, see [Recommended OUs and accounts](https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/recommended-ous-and-accounts.html) in the AWS white paper.