AWS controltower: Rename Control Tower shared accounts to service integration accounts
Summary
Terminology update renaming the 'audit' account to 'Config aggregator' account and the 'log archive' account to 'CloudTrail administrator' account, noting legacy names for landing zone versions earlier than 4.0, and clarifying that in 4.0+ the CloudTrail bucket stores only CloudTrail logs while Config logs go to a dedicated bucket.
Security assessment
The diff is a documentation rename of Control Tower accounts (audit->Config aggregator, log archive->CloudTrail administrator) plus a clarification of which logs land in which bucket. The access-restriction best-practice sentence is a rewording of pre-existing guidance, not new security content, and no specific vulnerability, CVE, or incident is referenced.
Evidence
+As a best practice, restrict access to this account to teams responsible for compliance and investigations, and their related security or audit tools. You can use this account for automated security audits. You can also host custom AWS Config Rules, such as Lambda functions, to perform remediation actions.
Diff
diff --git a/controltower/latest/userguide/special-accounts.md b/controltower/latest/userguide/special-accounts.md index e406d7484..698ab5832 100644 --- a//controltower/latest/userguide/special-accounts.md +++ b//controltower/latest/userguide/special-accounts.md @@ -7 +7 @@ -Management accountLog archive accountAudit account +Management accountCloudTrail administrator accountConfig aggregator account @@ -9 +9 @@ Management accountLog archive accountAudit account -# About the shared accounts +# Service integration accounts @@ -11 +11 @@ Management accountLog archive accountAudit account -Three special AWS accounts are associated with AWS Control Tower; the management account, the **audit** account, and the **log archive** account. These accounts usually are referred to as _shared accounts_ , or sometimes as _core accounts_. +AWS Control Tower uses three special AWS accounts: the management account, the **Config aggregator** account, and the **CloudTrail administrator** account. AWS Control Tower refers to the Config aggregator account and the CloudTrail administrator account as _service integration accounts_. @@ -13 +13 @@ Three special AWS accounts are associated with AWS Control Tower; the management - * You can select customized names for the audit and log archive accounts when you're setting up your landing zone. For information about changing an account name, see [Externally changing AWS Control Tower resource names](https://docs.aws.amazon.com/controltower/latest/userguide/external-resources.html#changing-names). +###### Legacy account names @@ -15 +15 @@ Three special AWS accounts are associated with AWS Control Tower; the management - * You also can specify an existing AWS account as an AWS Control Tower security or logging account, during the initial landing zone setup process. This option eliminates the need for AWS Control Tower to create new, shared accounts. (This is a one-time selection.) +In landing zone versions earlier than 4.0, these accounts were called _shared accounts_ (or sometimes _core accounts_). @@ -16,0 +17 @@ Three special AWS accounts are associated with AWS Control Tower; the management + * You can select customized names for the service integration accounts when you're setting up your landing zone. For information about changing an account name, see [Externally changing AWS Control Tower resource names](https://docs.aws.amazon.com/controltower/latest/userguide/external-resources.html#changing-names). @@ -17,0 +19 @@ Three special AWS accounts are associated with AWS Control Tower; the management + * You can also specify an existing AWS account as an AWS Control Tower service integration account, during the initial landing zone setup process. This option eliminates the need for AWS Control Tower to create new accounts. (This is a one-time selection.) @@ -20 +22,3 @@ Three special AWS accounts are associated with AWS Control Tower; the management -For more information about the shared accounts and their associated resources, see [Resources created in the shared accounts](./shared-account-resources.html). + + +For more information about the service integration accounts and their associated resources, see [Resources created in the shared accounts](./shared-account-resources.html). @@ -32 +36,3 @@ For more information about the roles and resources available in the management a -## Log archive account +## CloudTrail administrator account + +AWS Control Tower sets up the CloudTrail administrator account when you enable the AWS CloudTrail centralized logging integration. Alternatively, you can use an existing AWS account as the CloudTrail administrator account. You might know this account by its previous name: the log archive account. @@ -34 +40 @@ For more information about the roles and resources available in the management a -The log archive shared account is set up automatically when you create your landing zone, if you do not specifically bring another AWS account. +This account contains a central Amazon S3 bucket that stores log files for all other accounts in your landing zone. In landing zone versions earlier than 4.0, this bucket stores both AWS CloudTrail and AWS Config log files. In landing zone version 4.0 and later, this bucket stores only AWS CloudTrail log files. AWS Config stores its log files in a dedicated bucket in the Config aggregator account. @@ -36 +42 @@ The log archive shared account is set up automatically when you create your land -This account contains a central Amazon S3 bucket for storing a copy of all AWS CloudTrail and AWS Config log files for all other accounts in your landing zone. As a best practice, we recommend restricting log archive account access to teams responsible for compliance and investigations, and their related security or audit tools. This account can be used for automated security audits, or to host custom AWS Config Rules, such as Lambda functions, to perform remediation actions. +As a best practice, restrict access to this account to teams responsible for compliance and investigations, and their related security or audit tools. You can use this account for automated security audits. You can also host custom AWS Config Rules, such as Lambda functions, to perform remediation actions. @@ -48 +54 @@ These logs cannot be changed. All logs are stored for the purposes of audit and -## Audit account +## Config aggregator account @@ -50 +56 @@ These logs cannot be changed. All logs are stored for the purposes of audit and -This shared account is set up automatically when you create your landing zone, if you do not specifically bring another account. +AWS Control Tower sets up the Config aggregator account when you enable the AWS Config service integration. Alternatively, you can use an existing AWS account as the Config aggregator account. You might know this account by its previous name: the audit account. @@ -52 +58 @@ This shared account is set up automatically when you create your landing zone, i -The audit account should be restricted to security and compliance teams with auditor (read-only) and administrator (full-access) cross-account roles to all accounts in the landing zone. These roles are intended to be used by security and compliance teams to: +The Config aggregator account should be restricted to security and compliance teams with auditor (read-only) and administrator (full-access) cross-account roles to all accounts in the landing zone. These roles are intended to be used by security and compliance teams to: @@ -61 +67 @@ The audit account should be restricted to security and compliance teams with aud -The audit account also receives notifications through the Amazon Simple Notification Service (Amazon SNS) service. Three categories of notification can be received: +The Config aggregator account also receives notifications through the Amazon Simple Notification Service (Amazon SNS) service. You can receive three categories of notification: @@ -72 +78 @@ The audit account also receives notifications through the Amazon Simple Notifica -Audit notifications that are triggered within a member account also can send alerts to a local Amazon SNS topic. This functionality allows account administrators to subscribe to audit notifications that are specific to an individual member account. As a result, administrators can resolve issues that affect an individual account, while still aggregating all account notifications to your centralized audit account. For more information, see [Amazon Simple Notification Service Developer Guide](https://docs.aws.amazon.com/sns/latest/dg/). +Audit notifications that are triggered within a member account also can send alerts to a local Amazon SNS topic. This functionality allows account administrators to subscribe to audit notifications that are specific to an individual member account. As a result, administrators can resolve issues that affect an individual account, while still aggregating all account notifications to your centralized Config aggregator account. For more information, see [Amazon Simple Notification Service Developer Guide](https://docs.aws.amazon.com/sns/latest/dg/). @@ -74 +80 @@ Audit notifications that are triggered within a member account also can send ale -For more information about the roles and resources available in the audit account, see [Audit account resources](./shared-account-resources.html#audit-account-resources). +For more information about the roles and resources available in the Config aggregator account, see [Audit account resources](./shared-account-resources.html#audit-account-resources). @@ -80 +86 @@ For more information about programmatic auditing, see [Programmatic roles and tr -The email address you provide for the audit account receives **AWS Notification - Subscription Confirmation** emails from every AWS Region supported by AWS Control Tower. To receive compliance emails in your audit account, you must choose the **Confirm subscription** link within each email from each AWS Region supported by AWS Control Tower. +The email address you provide for the Config aggregator account receives **AWS Notification - Subscription Confirmation** emails from every AWS Region supported by AWS Control Tower. To receive compliance emails in your Config aggregator account, you must choose the **Confirm subscription** link within each email from each AWS Region supported by AWS Control Tower.