AWS Control Tower Popular2019年〜
A service that automates multi-account environment setup and governance
What It Does
AWS Control Tower is a service that sets up a multi-account AWS environment following best practices and continuously applies governance. It automatically builds a landing zone (a secure, standardized multi-account environment) and controls operations in each account using guardrails (preventive and detective policies). Pre-defined policies are automatically applied when new accounts are created.
Use Cases
Control Tower is used when organizations expand their AWS usage and need to safely create and manage separate accounts for each department. For example, it is used to create dedicated accounts for development teams, production environments, and security teams, and to apply common security policies (such as restricting usage to specific regions or requiring MFA for root users) across all accounts at once.
Everyday Analogy
Think of it like a franchise headquarters. Each store (AWS account) operates independently, but the headquarters (Control Tower) sets unified standards for store setup procedures, interior design, and hygiene rules. When a new store opens, it is automatically set up according to the headquarters' manual, and any operations that violate the rules are detected and corrected.
What Is Control Tower?
AWS Control Tower is a service for securely and efficiently managing multiple AWS accounts. AWS best practices recommend separating AWS accounts by workload or environment. However, as the number of accounts grows, maintaining unified security policies and compliance becomes challenging. Control Tower solves this problem by automating governance for multi-account environments.
Landing Zone
A landing zone is the foundation of the multi-account environment that Control Tower builds. During setup, it automatically configures an organizational structure with AWS Organizations, a log archive account, an audit account, and single sign-on through IAM Identity Center. You then add accounts for departments or projects on top of this foundation.
Guardrails
Guardrails are policies applied to each account. Preventive guardrails block prohibited operations from being executed in the first place (e.g., preventing resource creation in regions other than those specified). Detective guardrails detect states that violate policies and send notifications (e.g., when public access is enabled on an S3 bucket). They are offered in three tiers - mandatory, strongly recommended, and elective - so you can select guardrails that match your organization's requirements. For practical know-how on guardrails, related books on Amazon are also a great resource.
Getting Started
To get started with Control Tower, run "Set up landing zone" in the Control Tower console. Select a home region and configure the log archive and audit account settings, and the landing zone will be built in approximately 60 minutes. After that, creating new accounts through Account Factory automatically provisions them with guardrails already applied.
Things to Watch Out For
- Control Tower setup takes approximately 60 minutes, during which you should not perform other operations. Interrupting the setup may leave the environment in an inconsistent state
- Control Tower internally uses multiple services including Config, CloudTrail, and Organizations, so charges for those services will apply
- When introducing Control Tower to an existing AWS Organizations environment, verify compatibility with your existing account structure beforehand
