AWS controltower: Reformat CLI example and update IAM role notes for LZ v4
Summary
Reformatted the aws organizations move-account command with line continuations, fixed an anchor link for AWSControlTowerCloudTrailRole, and noted AWSControlTowerConfigAggregatorRoleForOrganizations is not required for landing zone 4.0+.
Security assessment
Touches IAM service role prerequisites and an account-move command, but only reformats examples and updates a role requirement note; no new security control or fix is described.
Evidence
+ * [`AWSControlTowerConfigAggregatorRoleForOrganizations`](https://docs.aws.amazon.com/controltower/latest/userguide/roles-how.html#config-role-for-organizations) (not required for landing zone version 4.0 and later)
Diff
diff --git a/controltower/latest/userguide/lz-api-prereques.md b/controltower/latest/userguide/lz-api-prereques.md index 0898036a4..4c484f98e 100644 --- a//controltower/latest/userguide/lz-api-prereques.md +++ b//controltower/latest/userguide/lz-api-prereques.md @@ -48,2 +46,4 @@ To set up your landing zone, AWS Control Tower allows customers to configure AWS - aws organizations move-account --account-id 0123456789012 --source-parent-id r-examplerootid111 --destination-parent-id ou-examplerootid111-security - + aws organizations move-account \ + --account-id 0123456789012 \ + --source-parent-id r-examplerootid111 \ + --destination-parent-id ou-examplerootid111-security @@ -60 +60 @@ Create the following IAM service roles in the `/service-role/` IAM path that ena - * [`AWSControlTowerCloudTrailRole`](https://docs.aws.amazon.com/controltower/latest/userguide/access-control-managing-permissions.html#AWSControlTowerCloudTrailRole) + * [`AWSControlTowerCloudTrailRole`](https://docs.aws.amazon.com/controltower/latest/userguide/access-control-managing-permissions.html#AWSControlTowerCloudTrailRolePolicy) @@ -64 +64 @@ Create the following IAM service roles in the `/service-role/` IAM path that ena - * [`AWSControlTowerConfigAggregatorRoleForOrganizations`](https://docs.aws.amazon.com/controltower/latest/userguide/roles-how.html#config-role-for-organizations) + * [`AWSControlTowerConfigAggregatorRoleForOrganizations`](https://docs.aws.amazon.com/controltower/latest/userguide/roles-how.html#config-role-for-organizations) (not required for landing zone version 4.0 and later)