Control Tower
Control Tower is how the organisation's accounts stay consistent. It owns the guardrails, the log archive and the account lifecycle; everything else in the landing zone builds on it.
What it provides
- A governed organisation. Accounts live in organisational units that carry different control sets.
- Guardrails. Preventive controls (SCPs) and detective controls (Config rules) applied by OU.
- Centralised logging. CloudTrail and Config delivered to a log archive account, configured automatically in every account and region.
- Account factory. A repeatable process for creating new accounts with the baseline already applied.
- Dashboard. A single view of account compliance and drift.
Organisational units
| OU | Purpose | Guardrail profile |
|---|---|---|
| Security | Log archive, audit, security tooling | Strictest; no workloads |
| Sandbox | Experimentation | Permissive; cost-limited; no production data |
| Infrastructure | Shared services, network | Strict; change-controlled |
| Workloads — dev | Development | Baseline; broad service access |
| Workloads — stage | Pre-production | Production-shaped |
| Workloads — prod | Production | Strict; region-restricted; change-controlled |
| Suspended | Decommissioned accounts | Deny-all until closure completes |
Controls in use
Preventive
- Disallow public S3 buckets.
- Disallow deletion of CloudTrail logs.
- Disallow configuration changes to the log archive.
- Require MFA for root user.
- Disallow root user access keys.
- Restrict regions to approved list.
- Require encryption on supported resources.
Detective
- CloudTrail enabled and logging in all accounts and regions.
- Config recording enabled.
- MFA enabled for console users.
- Public write access to S3 buckets prohibited.
- Encryption at rest on EBS, RDS, S3 and EFS.
- Root account usage alarm.
Region strategy
Governance is scoped to the regions actually used. A region-restriction SCP prevents resource creation elsewhere, which limits both attack surface and unbounded cost. Where a workload needs an additional region, the region is added to the approved list through a reviewed change — not by removing the control.
Operating the baseline
Baseline version
The control set is versioned. Accounts record which baseline version they were created with and which they currently satisfy.
Drift
Control Tower drift is reviewed weekly. Drift is either corrected or explicitly accepted with a recorded reason.
Updates
New controls are tested in sandbox and non-production OUs before production.
Exceptions
A control exception is time-bound, approved, recorded, and reviewed at expiry. There is no permanent exception.
Common problems
| Problem | Cause | Response |
|---|---|---|
| Account creation stalls | Account factory pipeline failure or email alias conflict | Check the factory run log; use a unique root email per account |
| Baseline drift | Console changes made outside Control Tower | Detect via Config, revert, and investigate how the access occurred |
| Controls block legitimate work | Control scope wider than intended | Narrow the control or add a documented exception — do not disable it |
| New region unsupported | Region restriction SCP | Add the region through a reviewed change |