AWS Control Tower

Short Summary

Managing access to applications, systems, and resources is increasingly complex in hybrid IT, with administrative (privileged) accounts posing outsized risk because they provide “keys to the kingdom.” Even when infrastructure management is partly delegated to cloud service providers, customers still administer their own cloud usage—provisioning resources, defining policies, and implementing controls that directly affect cost, performance, and security exposure. This work is often distributed across lines of business, and differing administrative interfaces across cloud vendors amplify inconsistency and operational risk.

A risk-based approach aligned to standards such as ISO/IEC 27001 is recommended, emphasizing that customers remain responsible for identity and access management regardless of service delivery. Core components for privileged access governance include: identity provisioning that enforces least privilege and timely privilege adjustment as roles change; authorization that restricts both what can be administered and the scope of administration, ideally through predefined templates for admin roles and system configurations; strong authentication such as MFA, preferably tied to a documented justification (e.g., change request) and supported by SSO to reduce credential sprawl; monitoring of all privileged activity to detect abnormal behavior and support change traceability; and auditing that enables point-in-time visibility into privileges and actions, regular independent reviews, and segregation of duties.

AWS Control Tower, generally available since June 2019, addresses governance challenges in multi-account AWS environments by automating a Landing Zone built on best-practice blueprints for identity, federated access, account structure, and centralized logging. It provides an account factory, preventive and detective guardrails expressed in plain English, and a dashboard for compliance visibility. While Control Tower itself has no additional charge, customers pay for enabled AWS services; adoption may be limited because Landing Zones are often delivered via AWS Professional Services, guardrails are English-only, and the product governs only the AWS portion of hybrid cloud.

Interesting Facts

• The AWS root (principal) account provides unlimited administrative access and is not recommended for routine work.
• AWS delegated administration is performed using IAM entities such as users and roles.
• AWS console access can be integrated with AWS Single Sign-On and identity federation using SAML.
• AWS supports administrative requests via console, CLI, or API, and successful requests result in AWS delivering the resource with associated payments and SLAs.
• Passwords are generally deprecated for administrative access in AWS compared to MFA and federation.
• AWS Control Tower was announced as generally available in June 2019.
• A Landing Zone created by AWS Control Tower uses AWS Organizations to establish a multi-account environment.
• The Landing Zone centralizes logging using AWS CloudTrail and AWS Config with storage in Amazon S3.
• Guardrails can be preventive (blocking nonconforming actions) or detective (monitoring and acting on nonconformance) and are translated into AWS policies.
• AWS Control Tower has no additional charges or commitments, but customers pay for the AWS services enabled to implement Landing Zones and guardrails.

Notable Quotes

• “administrator accounts provide the keys to the kingdom.”
• “the customer is always responsible for managing identity and access to their data and the resources they use.”
• “the provisioning process must ensure that only the minimum entitlements that are necessary for the administrators to do their job are given.”
• “Ideally there should be predefined templates not only for the administrator accounts but also for the configuration of the systems and services that they control.”
• “Privileged access should normally require stronger authentication such as MFA (Multi-Factor Authentication) and ideally should only be available with a documented cause”
• “The privileged user should not need to remember multiple sets of credentials to perform their task”
• “It is essential to monitor all privileged activity”
• “often the first sign of an attack in progress is abnormal behavior by a privileged account.”
• “Guardrails are pre-packaged governance rules for security, operations, and compliance”
• “customers are strongly encouraged to use it.”