> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Control Tower and Account Governance

> Overview of AWS Control Tower features for establishing and governing multi account AWS environments with landing zones, account factory, guardrails, centralized logging, and IAM Identity Center

Welcome.

In this lesson we cover AWS Control Tower — a managed AWS service that helps you establish, govern, and scale a well-architected multi-account AWS environment using AWS best practices.

What Control Tower does at a glance

* Creates a landing zone: a secure, well-architected foundation for a multi-account AWS Organization.
* Builds a recommended account structure (for example: management, log archive, audit, sandbox, test, staging, prod) and groups accounts into Organizational Units (OUs).
* Configures centralized Single Sign-On via AWS IAM Identity Center.
* Provides an Account Factory that automates provisioning of new accounts with baseline configurations and enforced guardrails.
* Allows you to import existing AWS accounts into the Control Tower-managed Organization for centralized governance.

![A schematic diagram of an AWS Control Tower / Landing Zone showing a Root account linked to several organizational units (Security with Log Archive and Audit accounts, Sandbox, Test, Staging, Prod) inside a dashed “Landing Zone” boundary. The AWS Control Tower icon appears at left.](https://mintcdn.com/kodekloud-c4ac6d9a/5BuH6-_lHDMy3nuh/images/AWS-Certified-DevOps-Engineer-Professional/Domain-2-Configuration-Management-and-IaC/AWS-Control-Tower-and-Account-Governance/aws-control-tower-landing-zone-accounts.jpg?fit=max\&auto=format\&n=5BuH6-_lHDMy3nuh\&q=85\&s=e2065f398684d7b04a70198680a22b94)

Because Control Tower automates the landing zone, your multi-account environment starts with consistent guardrails, centralized logging, and a repeatable account structure. Typical initial accounts created or recommended by Control Tower include a management account, a log archive account, and an audit account—each serving a distinct role in governance and security.

Accounts commonly provisioned by Control Tower

| Account | Primary purpose | Notes |
| - | - | - |
| Management (Root) | Central administration and billing | Controls the Organization and bootstraps Control Tower. |
| Log Archive | Centralized storage for logs | Stores CloudTrail, Config, and other logs for retention and analysis. |
| Audit | Security and monitoring | Read-only access for security teams, separate from day-to-day operations. |
| Sandbox / Dev / Test / Staging / Prod | Workloads and environment separation | Placed into Organizational Units (OUs) to apply different guardrails and access controls. |

Key components and benefits

* Landing zone: A pre-configured environment that accelerates secure account adoption.
* Account Factory: Automates account provisioning with baseline guardrails and network/security settings.
* IAM Identity Center (SSO): Centralizes user and role assignment across accounts and OUs.
* Guardrails: High-level rules implemented as Service Control Policies (SCPs), IAM policies, and AWS Config rules to enforce governance.

Guardrails: enforcement and visibility
Guardrails are the core enforcement mechanism in Control Tower. They let you enforce or monitor policies across many accounts consistently.

Guardrails are implemented using a combination of AWS Config rules, IAM policies, and Service Control Policies (SCPs). They can be applied at the Organizational Unit (OU) level so the same controls apply to every account placed in that OU.

Control Tower supports two primary guardrail types:

Preventive guardrails

* Purpose: Proactively block disallowed actions to prevent misconfiguration or insecure resources.
* How: Implemented as SCPs or IAM policies that stop operations before they occur.
* Examples: blocking public S3 buckets, restricting certain regions, preventing changes to centralized logging.

![A presentation slide titled "AWS Control Tower Guardrails" showing a "Preventive Guardrails" icon and brief points that these are proactive measures implemented via IAM policies, AWS Config and SCPs to restrict resource access and focus on prevention.](https://mintcdn.com/kodekloud-c4ac6d9a/5BuH6-_lHDMy3nuh/images/AWS-Certified-DevOps-Engineer-Professional/Domain-2-Configuration-Management-and-IaC/AWS-Control-Tower-and-Account-Governance/aws-control-tower-preventive-guardrails.jpg?fit=max\&auto=format\&n=5BuH6-_lHDMy3nuh\&q=85\&s=c7677244bc632af66acc0fa3da000096)

Detective guardrails

* Purpose: Monitor, detect, and report configuration drift or suspicious activities; provide visibility and forensics without necessarily blocking actions.
* How: Implemented via AWS Config rules, CloudWatch Events, and integrated logging/alerting to surface violations for remediation.
* Examples: detecting an EC2 instance launched without a key pair, identifying publicly accessible S3 buckets, or flagging resources created outside approved regions.

![A diagram titled "Preventive and Detective Guardrails" showing two workflows: a preventive guardrail blocking a user from creating a public Amazon S3 bucket, and a detective guardrail detecting/reporting an EC2 instance launched without a key pair. The image uses simple icons and arrows to illustrate the checks for S3 and EC2.](https://mintcdn.com/kodekloud-c4ac6d9a/5BuH6-_lHDMy3nuh/images/AWS-Certified-DevOps-Engineer-Professional/Domain-2-Configuration-Management-and-IaC/AWS-Control-Tower-and-Account-Governance/preventive-detective-guardrails-s3-ec2.jpg?fit=max\&auto=format\&n=5BuH6-_lHDMy3nuh\&q=85\&s=4263aee77ab5aa281d8bd8f31f428096)

Account Factory and Single Sign-On

* Account Factory (account vending) automates standard account creation: it provisions accounts into the correct OU, applies required baseline configurations (networking, logging, security), and ensures guardrails are attached.
* AWS IAM Identity Center (formerly AWS Single Sign-On) integrates with Control Tower so you can centrally provision user access and assign cross-account roles without creating separate IAM users in each account.

Bringing it all together

* Control Tower delivers a repeatable, well-architected multi-account baseline that enforces governance through preventive and detective guardrails.
* It centralizes security and logging, simplifies provisioning, and reduces drift by standardizing how accounts are configured and monitored.
* Existing accounts can be imported into Control Tower to bring legacy resources under the same governance model.

Further reading and references

* AWS Control Tower documentation: [https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.html](https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.html)
* AWS Organizations: [https://docs.aws.amazon.com/organizations/latest/userguide/orgs\_introduction.html](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html)
* IAM Identity Center (SSO): [https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html)

If you want to see these concepts in action, a live demo of Control Tower will show the landing zone layout, how guardrails behave (preventive vs detective), how the Account Factory provisions accounts, and how IAM Identity Center simplifies access management.

Thanks for reading.

> **[Watch Video](https://learn.kodekloud.com/user/courses/aws-certified-devops-engineer-professional/module/42510d3c-bacc-4a37-adb8-2cfea86f1a36/lesson/909e0310-327e-4e72-b877-605f0c163a43)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.