AWS controltower: Rename shared accounts to service integration accounts in Control Tower docs
Summary
Renames 'shared accounts' to 'service integration accounts' and updates account names (log archive -> CloudTrail administrator, audit -> Config aggregator). Also clarifies landing zone version qualifiers and adds AWSServiceRoleForAWSControlTower to the IAM roles lists.
Security assessment
The change is a terminology/account-naming refresh and version-qualifier clarification. It lists IAM roles and CloudTrail/Config resources but documents no new security control, fix, or vulnerability; the added service-linked role is informational.
Evidence
+AWS Identity and Access Management | Roles | aws-controltower-AdministratorExecutionRole aws-controltower-CloudWatchLogsRole aws-controltower-ConfigRecorderRole aws-controltower-ForwardSnsNotificationRole aws-controltower-ReadOnlyExecutionRole AWSControlTowerExecutionAWSServiceRoleForAWSControlTower
Diff
diff --git a/controltower/latest/userguide/shared-account-resources.md b/controltower/latest/userguide/shared-account-resources.md index 39e276b..4ded0c2 100644 --- a//controltower/latest/userguide/shared-account-resources.md +++ b//controltower/latest/userguide/shared-account-resources.md @@ -7 +7 @@ -Management account resourcesLog archive account resourcesAudit account resources +Management account resourcesCloudTrail administrator account resourcesConfig aggregator account resources @@ -9 +9 @@ Management account resourcesLog archive account resourcesAudit account resources -# Resources created in the shared accounts +# Resources created in the service integration accounts @@ -11 +11 @@ Management account resourcesLog archive account resourcesAudit account resources -This section shows the resources that AWS Control Tower creates in the shared accounts, when you set up your landing zone. +This section shows the resources that AWS Control Tower creates in the service integration accounts, when you set up your landing zone. @@ -21 +21 @@ AWS service | Resource type | Resource name -AWS Organizations | Accounts | audit log archive +AWS Organizations | Accounts | Config aggregator (audit) CloudTrail administrator (log archive) @@ -24,2 +24,2 @@ AWS Organizations | Service Control Policies | aws-guardrails-* -AWS CloudFormation | Stacks | AWSControlTowerBP-BASELINE-CLOUDTRAIL-MASTER AWSControlTowerBP-BASELINE-CONFIG-MASTER (in version 2.6 and later; not deployed in 4.0 and later) -AWS CloudFormation | StackSets | AWSControlTowerBP-BASELINE-CLOUDTRAIL (Not deployed in 3.0 and later) AWSControlTowerBP_BASELINE_SERVICE_LINKED_ROLE (Deployed in 3.2 and later) AWSControlTowerBP-BASELINE-CLOUDWATCH AWSControlTowerBP-BASELINE-CONFIG AWSControlTowerBP-BASELINE-ROLES AWSControlTowerBP-BASELINE-SERVICE-ROLES AWSControlTowerBP-SECURITY-TOPICS AWSControlTowerLoggingResources AWSControlTowerSecurityResources AWSControlTowerExecutionRole AWSControlTowerBP-CONFIG-CENTRAL-S3-BUCKET (Deployed in 4.0 and later) +AWS CloudFormation | Stacks | AWSControlTowerBP-BASELINE-CLOUDTRAIL-MASTER AWSControlTowerBP-BASELINE-CONFIG-MASTER (in landing zone version 2.6 and later; not deployed in landing zone version 4.0 and later) +AWS CloudFormation | StackSets | AWSControlTowerBP-BASELINE-CLOUDTRAIL (Not deployed in landing zone version 3.0 and later) AWSControlTowerBP-BASELINE-CLOUDWATCH AWSControlTowerBP-BASELINE-CONFIG AWSControlTowerBP-BASELINE-ROLES AWSControlTowerBP-BASELINE-SERVICE-ROLES AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE (Deployed in landing zone version 3.2 and later) AWSControlTowerBP-SECURITY-TOPICS AWSControlTowerLoggingResources AWSControlTowerSecurityResources AWSControlTowerExecutionRole AWSControlTowerBP-CONFIG-CENTRAL-S3-BUCKET (Deployed in landing zone version 4.0 and later) @@ -27 +27 @@ AWS Service Catalog | Product | AWS Control Tower Account Factory -AWS Config | Aggregator | aws-controltower-ConfigAggregatorForOrganizations (Not deployed in 4.0 and later) +AWS Config | Aggregator | aws-controltower-ConfigAggregatorForOrganizations (Not deployed in landing zone version 4.0 and later) @@ -41 +41 @@ As of June 2025, AWS Control Tower deploys detective controls as service-linked -## Log archive account resources +## CloudTrail administrator account resources @@ -43 +43 @@ As of June 2025, AWS Control Tower deploys detective controls as service-linked -When you set up your landing zone, the following AWS resources are created within your log archive account. +When you set up your landing zone, the following AWS resources are created within your CloudTrail administrator account. @@ -47 +47 @@ AWS service | Resource type | Resource Name -AWS CloudFormation | Stacks | StackSet-AWSControlTowerBP-BASELINE-CLOUDWATCH- StackSet-AWSControlTowerBP-BASELINE-CONFIG- StackSet-AWSControlTowerBP-BASELINE-CLOUDTRAIL- StackSet-AWSControlTowerBP-BASELINE-SERVICE-ROLES- StackSet-AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE-(In 3.2 and later) StackSet-AWSControlTowerBP-BASELINE-ROLES- StackSet-AWSControlTowerLoggingResources- +AWS CloudFormation | Stacks | StackSet-AWSControlTowerBP-BASELINE-CLOUDWATCH- StackSet-AWSControlTowerBP-BASELINE-CONFIG- StackSet-AWSControlTowerBP-BASELINE-CLOUDTRAIL- StackSet-AWSControlTowerBP-BASELINE-SERVICE-ROLES- StackSet-AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE-(In landing zone version 3.2 and later) StackSet-AWSControlTowerBP-BASELINE-ROLES- StackSet-AWSControlTowerLoggingResources- @@ -52 +52 @@ Amazon CloudWatch | CloudWatch Logs | /aws/lambda/aws-controltower-NotificationF -AWS Identity and Access Management | Roles | aws-controltower-AdministratorExecutionRole aws-controltower-CloudWatchLogsRole aws-controltower-ConfigRecorderRole aws-controltower-ForwardSnsNotificationRole aws-controltower-ReadOnlyExecutionRole AWSControlTowerExecution +AWS Identity and Access Management | Roles | aws-controltower-AdministratorExecutionRole aws-controltower-CloudWatchLogsRole aws-controltower-ConfigRecorderRole aws-controltower-ForwardSnsNotificationRole aws-controltower-ReadOnlyExecutionRole AWSControlTowerExecutionAWSServiceRoleForAWSControlTower @@ -59 +59 @@ Amazon Simple Storage Service | Buckets | aws-controltower-logs-* aws-controltow -## Audit account resources +## Config aggregator account resources @@ -61 +61 @@ Amazon Simple Storage Service | Buckets | aws-controltower-logs-* aws-controltow -When you set up your landing zone, the following AWS resources are created within your audit account. +When you set up your landing zone, the following AWS resources are created within your Config aggregator account. @@ -65,3 +65,3 @@ AWS service | Resource type | Resource name -AWS CloudFormation | Stacks | StackSet-AWSControlTowerBP-BASELINE-CLOUDWATCH- StackSet-AWSControlTowerBP-BASELINE-CONFIG- StackSet-AWSControlTowerBP-BASELINE-CLOUDTRAIL- StackSet-AWSControlTowerBP-BASELINE-SERVICE-ROLES- StackSet-AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE-(In 3.2 and later) StackSet-AWSControlTowerBP-SECURITY-TOPICS- StackSet-AWSControlTowerBP-BASELINE-ROLES- StackSet-AWSControlTowerSecurityResources-* StackSet-AWSControlTowerBP-CONFIG-CENTRAL-S3-BUCKET- (Deployed in 4.0 and later) -AWS Config | Aggregator | aws-controltower-GuardrailsComplianceAggregator (Not deployed in 4.0 and later) -AWS Config | Aggregator | aws-controltower-ConfigAggregatorForOrganizations (Deployed in 4.0 and later) +AWS CloudFormation | Stacks | StackSet-AWSControlTowerBP-BASELINE-CLOUDWATCH- StackSet-AWSControlTowerBP-BASELINE-CONFIG- StackSet-AWSControlTowerBP-BASELINE-CLOUDTRAIL- StackSet-AWSControlTowerBP-BASELINE-SERVICE-ROLES- StackSet-AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE-(In landing zone version 3.2 and later) StackSet-AWSControlTowerBP-SECURITY-TOPICS- StackSet-AWSControlTowerBP-BASELINE-ROLES- StackSet-AWSControlTowerSecurityResources-* StackSet-AWSControlTowerBP-CONFIG-CENTRAL-S3-BUCKET- (Deployed in landing zone version 4.0 and later) +AWS Config | Aggregator | aws-controltower-GuardrailsComplianceAggregator (Not deployed in landing zone version 4.0 and later) +AWS Config | Aggregator | aws-controltower-ConfigAggregatorForOrganizations (Deployed in landing zone version 4.0 and later) @@ -72 +72 @@ Amazon CloudWatch | CloudWatch Logs | /aws/lambda/aws-controltower-NotificationF -AWS Identity and Access Management | Roles | aws-controltower-AdministratorExecutionRole aws-controltower-CloudWatchLogsRole aws-controltower-ConfigRecorderRole aws-controltower-ForwardSnsNotificationRole aws-controltower-ReadOnlyExecutionRole aws-controltower-AuditAdministratorRole aws-controltower-AuditReadOnlyRole AWSControlTowerExecution +AWS Identity and Access Management | Roles | aws-controltower-AdministratorExecutionRole aws-controltower-CloudWatchLogsRole aws-controltower-ConfigRecorderRole aws-controltower-ForwardSnsNotificationRole aws-controltower-ReadOnlyExecutionRole aws-controltower-AuditAdministratorRole aws-controltower-AuditReadOnlyRole AWSControlTowerExecutionAWSServiceRoleForAWSControlTower @@ -76 +76 @@ AWS Lambda | Functions | aws-controltower-NotificationForwarder -Amazon Simple Storage Service | Buckets | aws-controltower-config-logs-* (Deployed in 4.0 and later) aws-controltower-config-access-logs-* (Deployed in 4.0 and later) +Amazon Simple Storage Service | Buckets | aws-controltower-config-logs-* (Deployed in landing zone version 4.0 and later) aws-controltower-config-access-logs-* (Deployed in landing zone version 4.0 and later)