JUSTIN SAMUEL

SCS-C03 #3: Control Tower.

Note: This is the third post in my AWS SCS-C03 series. You can see the rest of the posts in the series using the link above.

Control Tower
- Allows for quick, easy setup of a multi-account environment in AWS (this is known as the landing zone)
  - To do this, it makes use of other AWS services such as Organisations, IAM Identity Centre, CloudFormation, AWS Config, and more.
- Guard Rails / Controls can be used to mandate rules and standards across all accounts
  - These controls are:
    - Elective – you can choose these fully. Elective controls can either detect behaviour for auditing, or prevent it.
    - Strongly recommended – these can be deactivated, but are recommended due to being best practice for Well-Architected multi-account environments
    - Mandatory – these cannot be disabled as they protect AWS Control Tower resources
  - Preventive guardrails, in a similar vein to SCPs, do not apply to the Management account.
- Account Factory automates and standardises the creation of new accounts
- Dashboard provides oversight of the landing zone to the cloud admins.
- Creates two OUs (Organisation Units) – one called the Security OU, and one called the Sandbox OU (optional).
  - Sandbox OU and other registered OUs contain enrolled accounts.
  - Security OU contains both the Log Archive and Audit accounts.
  - If you like, you can create more OUs.
- IAM Identity Centre allows for single sign-on (SSO) and ID Federation.

Thanks for reading!

-J