AWS controltower: Control Tower landing zone v4.0 OU structure and service integration OU changes
Summary
Rewrites the landing zone structure description: in v4.0 a Security OU is no longer required and users can define their own org structure; introduces the concept of a designated service integration OU that must be nested directly under root, and replaces the fixed Log Archive/Audit shared-account creation with enrollment of accounts for enabled service integrations.
Security assessment
The change documents an architectural/organizational update to how Control Tower provisions OUs and service integration accounts. It touches security-relevant concepts (Security OU, shared accounts) but describes structure and behavior rather than a vulnerability, fix, or new security control.
Evidence
In AWS Control Tower landing zone version 4.0, AWS Control Tower no longer requires a Security OU, and you can define your own organizational structure.
Diff
diff --git a/controltower/latest/userguide/how-control-tower-works.md b/controltower/latest/userguide/how-control-tower-works.md index 21d3cca03..009f1cf4d 100644 --- a//controltower/latest/userguide/how-control-tower-works.md +++ b//controltower/latest/userguide/how-control-tower-works.md @@ -19 +19,5 @@ The structure of a landing zone in AWS Control Tower is as follows: - * **Security OU** – This OU contains the Log Archive and Audit accounts. These accounts often are referred to as _shared accounts_. When you launch your landing zone, you can choose customized names for these shared accounts, and you have the option to bring existing AWS accounts into AWS Control Tower for security and logging. However, these cannot be renamed later, and existing accounts cannot be added for security and logging after initial launch. + * **Security OU** – When you launch your landing zone, you can choose customized names for accounts in the Security OU, and you can bring existing AWS accounts into AWS Control Tower for service integrations. + +In AWS Control Tower landing zone version 3.3 and earlier, this OU contains the Log Archive and Audit accounts. These accounts are called _shared accounts_. In landing zone version 3.3 and earlier, you cannot add existing accounts for security and logging after initial launch. + +In AWS Control Tower landing zone version 4.0, AWS Control Tower no longer requires a Security OU, and you can define your own organizational structure. @@ -34 +38,5 @@ When you set up a landing zone, AWS Control Tower performs the following actions - * Creates two AWS Organizations organizational units (OUs): Security, and Sandbox (optional), contained within the organizational root structure. + * When you create your landing zone through the console, AWS Control Tower creates two AWS Organizations organizational units (OUs). These are the Security OU and the optional Sandbox OU, contained within the organizational root structure. During setup, AWS Control Tower automatically selects the Security OU as the default OU for service integrations. This OU is known as the designated service integration OU. You can select a different OU during landing zone setup. + +AWS Control Tower requires all accounts configured for AWS service integrations to be under the same OU, nested directly under root. This requirement does not apply to the management account. + +When you create your landing zone through the API, you do not explicitly select an OU for service integrations. Service integration accounts must be under the same OU nested directly under root, and the OU that contains your service integration accounts is the designated service integration OU. For more information, see [Getting started with AWS Control Tower APIs](https://docs.aws.amazon.com/controltower/latest/userguide/getting-started-apis.html). @@ -36 +44 @@ When you set up a landing zone, AWS Control Tower performs the following actions - * Creates or adds two shared accounts in the Security OU: the Log Archive account and the Audit account. + * AWS Control Tower creates or enrolls accounts for any enabled service integrations (such as AWS Config, AWS CloudTrail, or AWS Backup) in the designated service integration OU.