Demo SSO Audit and Security inside of a Control Tower account

In this walkthrough you’ll see a hands-on demo of AWS Control Tower: setting up a landing zone, registering and provisioning managed accounts, and viewing how IAM Identity Center (SSO), audit, and log-archive integrations are configured automatically. This guide follows the Control Tower setup flow and highlights the key screens, decisions, and outcomes you will encounter.

​

Getting started

1. Open the AWS Console and search for the AWS Control Tower service.
2. Launch the landing zone setup wizard. The wizard lists the actions Control Tower will perform and includes links to pricing and permissions.
3. Choose a Home Region for your Control Tower account (this demo uses US East (N. Virginia)). Optionally enable the “Region deny” setting to block access to services in regions not governed by Control Tower. These settings are changeable later.

Select additional regions to govern if you need multi-region enforcement. The Home Region is selected automatically.

​

Configure Organizational Units (OUs)

Control Tower creates Organizational Units (OUs) to organize accounts and apply guardrails. By default, Control Tower creates a foundational OU containing the Log archive and Security (audit) accounts. Optionally add a Sandbox or development OU for non-production workloads.

​

Configure shared accounts

The Management account is the account where you initiate Control Tower. You must supply or create a unique email address for the Log archive account and the Audit (security) account. You may create new accounts during the setup or use existing ones.

​

Logging, CloudShell, and encryption

Continue through the account access and CloudShell configuration screens (default options are acceptable for most setups). Optionally configure S3 logging details (retention and format) and KMS encryption for log buckets to meet your security and compliance requirements.

​

Review and provision the landing zone

Review the configuration, accept the IAM permissions that Control Tower requires, and start provisioning. Provisioning typically takes several minutes as Control Tower:

• Creates OUs and shared accounts
• Configures IAM Identity Center (formerly AWS SSO)
• Applies mandatory preventive and detective controls (guardrails)

When provisioning completes, the Control Tower summary displays the configured OUs and shared accounts. This demo shows two OUs (Root -> Security + Sandbox) and three shared accounts (Management, Log archive, Audit).

​

Guardrails and controls library

Control Tower provisions both preventive controls (to enforce policies) and detective controls (to detect drift or violations). The Controls library organizes guardrails by objectives such as Security, Operational Excellence, and Cost Optimization. Example controls include:

• Enforcing logging for API Gateway REST and WebSocket APIs
• Detecting unattached Amazon EBS volumes
• Identifying and cleaning up stopped EC2 instances to reduce costs

​

IAM Identity Center (SSO) and user activation

AWS sends welcome emails to each managed account created. IAM Identity Center also sends invitation emails to any users that were created for portal access. Accept the IAM Identity Center invitation and set a password to activate the user. Control Tower seeds IAM Identity Center with initial users (for example, a Control Tower admin user). From the IAM Identity Center console you can review users and their status. After accepting the invitation, sign in to the IAM Identity Center user portal. The portal displays the accounts and roles available to that user — for example: Audit, Log Archive, main, and any provisioned workload accounts — plus assigned roles such as AWSAdministratorAccess or Service Catalog roles.

​

Creating new accounts with Account Factory

Control Tower includes Account Factory (implemented as an AWS Service Catalog product) for provisioning new governed accounts with standardized configuration. You can review and customize the default network and resource configuration (for example, VPC CIDR, number of private subnets, and whether public subnets are allowed). By default, Control Tower disallows public subnets for provisioned accounts, but you can change this behavior to meet your requirements. To provision a new account from Account Factory:

• Provide a unique email address and a display name for the account.
• Specify the IAM Identity Center user that should be created for administrative access to that account.
• Select the target Organizational Unit and optionally choose a Service Catalog product configuration.
• Submit the request — Account Factory creates the AWS account, enrolls it in the organization, applies guardrails, and configures IAM Identity Center mappings.

​

Verification and compliance status

After a few minutes, verify that the new account appears in the Control Tower console under the selected OU and that it shows as Enrolled and Compliant. The account details view lists enabled controls (guardrails) and other metadata. Control Tower automates the repetitive work of standardizing new accounts so you don’t need to manually reapply the same policies, network settings, or role mappings.

​

Quick reference table

​

Links and references

• AWS Control Tower documentation
• AWS IAM Identity Center (formerly AWS SSO)
• AWS Organizations
• AWS Service Catalog

​

Conclusion

AWS Control Tower simplifies multi-account governance by automating landing zone provisioning, guardrail enforcement, centralized IAM Identity Center configuration, and standardized account creation through Account Factory. This demo covered the end-to-end flow from initial setup through account provisioning and verification.