👋 Hey there! I’m Sarvar, a Cloud Architect passionate about cutting-edge technologies. With years of experience in Cloud Operations (Azure and AWS), Data Operations, Data Analytics, and DevOps, I've had the privilege of working with clients around the globe, delivering top-notch results. I’m always exploring the latest tech trends and love sharing what I learn along the way. Let’s dive into the world of cloud and tech together! 🚀

I have just completed the one section of the AWS Security Specialty Certification course at QA.com (Learning Platform) it is on of the best benefit of the AWS Community Builder program. During the course, I got some key takeaways on how you could do multi-account management and I wanted to capture them into an article. All notes are based on my own learning journey and experiences — new comers to AWS control tower and Landing Zones can more easily understand the basic aspects. So let's get started.....

Introduction to AWS Control Tower:

AWS Control Tower is a service you can use to more easily set up and govern a secure, multi-account AWS environment based on best practices established through AWS' experience working with thousands of enterprises as they move to the cloud. In simpler terms, it allows you to create and manage multiple AWS accounts as well as enforce security and compliance against all of your AWS in a single place. Control Tower automates the set-up of a baseline environment required to perform multi-account governance, applies guardrails and operational policies for security, and simplifies account provisioning using pre-configured management best practices. This can often making the cross-departmental and team-level scaling a huge pain as it avoids enterprises organizations the complexity of having to set up these configurations from scratch.

Why Use a Multi-Account Setup?

Multiple AWS accounts has much more advantages. This allow organizations to separate workloads into production environments, dev environments, and logging infrastructure. These segments are used to monitor costs per department, or project and for the efficient resource management, as well as to provide security boundaries. But control of multiple account becomes easily a nightmare especially in cases where company grows. AWS Control Tower makes this easy by providing tools to govern these accounts at scale and enforce security and compliance across your AWS environment centrally.

What is a Landing Zone?

The very base setup of a multi-account environment in AWS is called a Landing Zone. This creates a secure, scalable and well governed environment for you to create and manage your AWS accounts. AWS Control Tower sets up a Landing Zone for you and Landing zone will create the VPC, Organizational Units (OUs), Roles per account and built in security & compliance. The Landing Zone is the location where you set and enforce organizational policies across accounts, administer identities and best practices are Implemented by your teams.

Setting Up a Landing Zone with AWS Control Tower:

In the first steps of setting up landing zone is to configure aws Organizations as account management and create 3 Organizational units (OUs). By organizing your accounts into following OUs, you set a strong foundation of compliance and operations to help to better construct and enforce security guardrails and account management guardrails across your AWS environment. Below is a list of each OU and it's intended use-case:

1. Root OU:
The Root Organizational Unit (OU) is the top-level parent OU in your AWS Organization's hierarchy, where all other OUs and accounts reside. As the primary container for your entire AWS environment, policies applied at the Root level trickle down to all nested OUs and accounts, ensuring that any governance or security mandates you establish are inherited throughout the hierarchy. While you can apply AWS Service Control Policies (SCPs) at the Root level to enforce high-level security and compliance requirements across all accounts, it is generally advisable to apply SCPs more selectively at lower OUs to avoid excessive restrictions at the Root level.

2. Security OU:
The Security OU is a specialized OU dedicated to maintaining and enforcing security and compliance across your AWS environment, housing critical accounts like the Log Archive and Audit accounts essential for centralized monitoring, logging, and auditing. The Log Archive Account serves as a centralized repository for logs from other accounts, enhancing log retention, security, and accessibility for monitoring purposes, and should store logs such as AWS CloudTrail, AWS Config, VPC Flow Logs, and application logs. The Audit Account is used by security teams to conduct audits and assessments across all accounts, with permissions to access services like AWS Config and CloudTrail, and the capability to run tools for vulnerability and compliance checks. Strict SCPs can be enforced at the Security OU level to prevent log deletions and ensure security services remain enabled, while IAM roles provide cross-account access for security teams, maintaining separation between production and security functions.

3. Sandbox OU:
The Sandbox OU provides a separate space for development, testing, or experimental accounts, with generally less restrictive access to allow developers to explore new services, prototype solutions, and test configurations in a low-risk environment. It contains multiple accounts tailored for different purposes, such as Development Accounts for building and testing applications without impacting production, Testing Accounts for integration and QA testing, and Experimentation Accounts for exploratory work with new AWS services or proofs of concept (POCs). Given the inherently higher-risk nature of Sandbox OUs, SCPs are often configured to restrict access to sensitive resources or services, as well as specific AWS regions, to control costs and minimize data residency risks.

4. Other OU:
A majority of companies get rid of the default OUs like Root, Security, and Sandbox and include additional OUs such as the ones connected to your special needs. This additional OUs are really convenient in terms of multiple accounts for different purposes. Here are some of these common ones.

• Production OU: This is where you would store the accounts that are running the live applications – i.e. the stuff that needs to be up all of time and most secure. So naturally, you’d want stricter controls here, maybe some extra policies to make sure everything is locked down and follows security best practices. Usually, this OU will have separate accounts for different teams or projects, all set up in isolated environments to keep the live systems safe.
• Shared Services OU: In this OU, you keep the services that various teams across the company will share. Think of things like central networking, identity management, or tools everyone needs access to. You’d put specific policies here so that only the right people can access these shared services, making sure everything is used securely but remains available to those who need it.
• Data OU: This one’s for any data-heavy stuff, like storage, analysis, or big data processing. You might have accounts here that handle data lakes or do data crunching tasks. The policies here are usually set up to control who can access data storage (like S3 or Redshift), with a focus on keeping the data safe and compliant with any storage rules.

Policy Management in AWS Organizations:

Through the use of Service Control Policies (SCPs), Policy Management gives you centralized control over the actions that are permitted in your AWS accounts by enforcing regulations across various Organizational Units (OUs). You can implement robust security measures on crucial OUs, such as the Security OU, which may contain crucial accounts for logging and auditing, by applying SCPs selectively to those OUs. This will guarantee that security policies are strictly adhered to and that services like AWS CloudTrail or AWS Config cannot be disabled. On the other hand, more flexible policies that encourage innovation might be implemented in the Sandbox OU, where developers concentrate on testing and experimenting. Examples of such policies include restricting access to certain regions or limiting access to expensive services in order to control costs and lower risk.

Managing Accounts in AWS Control Tower:

There are multiple ways to create and manage accounts with AWS Control Tower. Administrators can easily provide new accounts with Account Factory, a tool that lets you do so right from the Control Tower dashboard. To put your current accounts under the same rules and regulations as new ones, you can enroll them in Control Tower. More customization and flexibility are made possible by Control Tower's automated provisioning options, which are made possible by programs like Terraform and AWS Lambda.

For instance, you can describe your setups and accounts in code if you're using Terraform. Control Tower will expedite the provisioning process by automatically creating these accounts in accordance with your instructions. This saves time and lowers the possibility of human mistake by making it simple to set up accounts with consistent setups and governance.

Control Tower’s Security Controls:

More than 400 security and compliance controls are available for your accounts to use with Control Tower. By ensuring that accounts adhere to industry standards and best practices, these controls assist maintain compliance. It is possible for controls to be Strongly Recommended, Elective, or Mandatory (needed for all accounts). Through the Control Tower console, which is maintained by AWS, you can search for controls based on compliance frameworks such as NIST or PCI DSS. Three different types of controls are available through AWS Control Tower to ensure security and compliance across all accounts:

1. Detective Controls: These keep an eye on your accounts and notify you when any policies are breached. For instance, you may activate a control that determines whether public access is allowed on specific resources or whether root users are utilizing Multi-Factor Authentication (MFA). Detective controls help in making sure you are aware of any possible security threats in your surroundings.
2. Preventive Controls: These stop activities that might go against security guidelines. A preventive control might, for instance, forbid making modifications to an S3 bucket policy that would permit open access. AWS Service Control Policies (SCPs), which limit access to particular actions across your accounts, implement these controls.
3. Proactive Controls: These more recent rules prevent the creation of resources that aren't compliant in the first place. CloudFormation Guard is used by AWS Control Tower to enforce these regulations, making sure that only resources that comply are provisioned. One way to do this would be to mandate server-side encryption for every newly formed S3 bucket.

Every control offers flexibility in how you implement security throughout your environment because it may be applied to individual accounts or to an entire Organization.

Managing Access with IAM Identity Center:

IAM Identity Center, formerly AWS Single Sign-On, is used by AWS Control Tower to control user access and permissions across accounts. You can manage user rights and create a centralized directory from a single location using IAM Identity Center. For administrators who require complete access to the Control Tower interface, you could, for instance, create a group called "Control Tower Admins." Then, users can effortlessly control their access to AWS by logging in using their current credentials from providers like Azure AD or Okta. Control Tower also lets you manage access directly using IAM policies or link to an external identity provider if you have specific access requirements.

Cost Considerations:

Although AWS Control Tower is free, there are fees associated with the services it makes possible, such as AWS Config, CloudTrail, and GuardDuty. It is essential to understand the hidden expenses associated with these services when establishing a multi-account setup. You may monitor and optimize costs across accounts with AWS Control Tower's connection with AWS Cost Explorer and billing tools, which will facilitate efficient expense allocation and budget management.

Unmanaging Accounts in AWS Control Tower:

Unmanaging an account will allow you to take it out of Control Tower's governance if you ever need to. This removes the account from the Landing Zone and any applicable controls, but it doesn't erase the account or impact user access. If an account needs to be transferred outside of your company or is no longer under Control Tower's supervision, you may decide to unmanage it. Simply go to the Account Factory page, choose the account, and click "Unmanage" to end account management. Remember that losing control over accounts might affect compliance, so carefully consider your options before making this decision.

Conclusion: AWS Control Tower is a powerful tool for companies trying to streamline and safeguard their multi-account AWS setups. Control Tower helps teams manage accounts more efficiently and concentrate on innovation by offering centralized account administration, uniform security policies, and easier provisioning. A crucial component that helps in enforcing security best practices and enables firms to easily maintain compliance across numerous accounts is the Landing Zone arrangement.

— — — — — — — —
Here is the End!

✨ Thank you for reading! ✨ I hope this article helped simplify the process and gave you valuable insights. As I continue to explore the ever-evolving world of technology, I’m excited to share more guides, tips, and updates with you. 🚀 Stay tuned for more content that breaks down complex concepts and makes them easier to grasp. Let’s keep learning and growing together! 💡