Demo Control Tower and AWS Organizations

In this lesson we walk through AWS Organizations and AWS Control Tower — how they relate, how to create Organizational Units (OUs), and how Control Tower builds a governed multi-account landing zone on top of Organizations. This guide assumes you have console access to your AWS Organization (the Management account) and permission to view and modify organizational units and Control Tower settings.

​

Overview: Organizations vs Control Tower

• AWS Organizations provides the foundational multi-account structure: a Root, a Management account, and Organizational Units (OUs) to group member accounts.
• AWS Control Tower builds on Organizations to deliver a preconfigured “landing zone” with centralized governance, guardrails, account provisioning, and centralized logging.

​

Open AWS Organizations and create an OU

1. Open the AWS console and search for AWS Organizations, then select it.
2. If this is your first time, you may see an introductory page. Open the left panel and choose AWS accounts to view your organization structure.
3. You will see the top-level Root and the Management account for the organization. The Management account administers the organization.
4. To create an OU:
   • Select the Root.
   • From the Actions menu choose Create organizational unit (or Create new).
   • Provide a name (for example, testing) and create it.

An OU is a container to group AWS accounts so governance, guardrails, and policies can be applied consistently. You should now see the OU you created under the Root alongside the management account.

​

Open and prepare AWS Control Tower

Return to the console and open AWS Control Tower. Control Tower uses your Organization to deploy a multi-account landing zone with security, governance, and logging configured. Control Tower setup builds a landing zone that typically includes:

• A Security OU that contains centralized logging and auditing accounts.
• A Log Archive account and an Audit account for centralized logs and audit access.
• Guardrails (Controls) from the Controls catalog which can be preventive, detective, or proactive.

Before enabling Control Tower, watch for an AWS Config organization-wide setup conflict. If Control Tower cannot enable in the chosen region, the console will display a message explaining the issue and suggesting remediation.

​

Control Tower setup flow

When you begin Control Tower setup you’ll move through several steps:

1. Setup preference — choose the type of environment. For a full landing zone, select the complete environment.
2. Home region — select the primary region for the Control Tower landing zone (us-east-1 is a common choice).
3. Organizational units — Control Tower will present foundational OUs (e.g., Security, Sandbox). Choose which OUs to create or manage.

Control Tower will show the OUs it intends to create or manage. In many landing zones the Security OU is used for centralized logging and auditing.

​

Configure service integrations

Next is the Configure service integration step. Here you select which AWS services to integrate and choose the default OU for those integrations. By convention, the Security OU is often chosen as the default OU so logging, auditing, and security-related integrations are centralized.

​

Centralized logging with AWS CloudTrail

For centralized logging, enable AWS CloudTrail centralized logging. Control Tower will ask you to designate a CloudTrail administrator account. Best practice is to create a dedicated CloudTrail administrator account separate from the Management account. This account will hold centralized CloudTrail logs centrally and securely.

• Create the CloudTrail administrator account by providing an email and account name.
• Ensure the account status is Active before proceeding.

​

Review and enable Control Tower

Review the configuration summary and enable AWS Control Tower. Building a landing zone can take significant time (the console often shows an estimated duration, for example ~35 minutes). Monitor progress in the Control Tower console and wait for the setup to complete. After setup, Control Tower governs your multi-account environment, using Organizations for account/OUs and applying guardrails across accounts.

​

Inspect Organization and Controls in Control Tower

Use the Control Tower organizational and resources views to inspect the OUs, accounts, and the status of controls and resources created by Control Tower. Control Tower includes a Controls catalog. Controls are governance rules (preventive, detective, or proactive) you can enable to enforce compliance and best practices across accounts and OUs. The Control Catalog lists available controls and indicates which are enabled.

​

Provision accounts with Account Factory

Account Factory is the Control Tower feature for provisioning new accounts in a standardized, governed manner. Define account configuration templates (networking, SSO settings, tags, etc.) so newly provisioned accounts inherit required settings and guardrails.

​

Landing Zone settings and governance

From the Control Tower dashboard, review your Landing Zone settings. These settings display:

• The Control Tower version
• The Home region (primary region for Control Tower, e.g., US East (N. Virginia) — us-east-1)
• The list of governed regions and enabled services (for example, AWS CloudTrail)

The landing zone is the standardized, governed foundation for a multi-account AWS environment. Use Control Tower to maintain consistent governance across your organization.

​

Quick troubleshooting and best practices

• If Control Tower setup fails due to AWS Config, either pick a different home region or remove organization-wide AWS Config in the target region.
• Use a dedicated CloudTrail admin account to isolate audit logs.
• Use OUs to group accounts by lifecycle or responsibility (for example, Security, Sandbox, Production).
• Automate account provisioning via Account Factory or the AWS Organizations API to keep accounts compliant at creation.

​

Links and references

• AWS Organizations — Introduction
• AWS Control Tower — What is Control Tower?
• Control Tower — Landing zone overview
• Account Factory (Control Tower)
• AWS CloudTrail — User guide
• AWS Config — What is AWS Config?

That concludes this demo lesson on AWS Organizations and AWS Control Tower.