AWS controltower: Describe centralized AWS Config data for auditing and compliance
Summary
Added text explaining that Control Tower centralizes AWS Config data across enrolled accounts to support auditing and compliance demonstration, and reworded the delivery channel description.
Security assessment
Documents centralized AWS Config recording and delivery for auditing/compliance, which is security-relevant logging/audit guidance, but it describes an existing capability rather than fixing a specific vulnerability.
Evidence
+AWS Control Tower enables AWS Config on all enrolled accounts, so that it can monitor compliance through detective controls, record resource changes, and deliver resource change logs to a centralized account. AWS Control Tower centralizes this AWS Config data so that you can review resource configuration changes from all enrolled accounts in one place, which helps you audit your environment and demonstrate compliance.
Diff
diff --git a/controltower/latest/userguide/monitoring-with-config.md b/controltower/latest/userguide/monitoring-with-config.md index 28d7a40e4..d41231d86 100644 --- a//controltower/latest/userguide/monitoring-with-config.md +++ b//controltower/latest/userguide/monitoring-with-config.md @@ -11 +11 @@ View the AWS Config recorder data on enrolled accountsTroubleshooting AWS Config -AWS Control Tower enables AWS Config on all enrolled accounts, so that it can monitor compliance through detective controls, record resource changes, and deliver resource change logs to a centralized account. +AWS Control Tower enables AWS Config on all enrolled accounts, so that it can monitor compliance through detective controls, record resource changes, and deliver resource change logs to a centralized account. AWS Control Tower centralizes this AWS Config data so that you can review resource configuration changes from all enrolled accounts in one place, which helps you audit your environment and demonstrate compliance. @@ -26 +26 @@ AWS Control Tower enables AWS Config on all enrolled accounts, so that it can mo -AWS Control Tower sets up an AWS Config delivery channel in all enrolled accounts. Through this delivery channel, it logs all recorded changes in a centralized account, where they are stored in an Amazon Simple Storage Service bucket. The name and location of the Amazon S3 bucket depend on your landing zone version: +AWS Control Tower sets up an AWS Config delivery channel in each enrolled account. The delivery channel delivers recorded changes to a centralized account, where AWS Config stores them in an Amazon Simple Storage Service bucket. The name and location of the Amazon S3 bucket depend on your landing zone version: