AWS Control Tower
- What it is
- Automated setup and ongoing governance of a secure, multi-account AWS environment — a “landing zone” — in a few clicks.
- Built on top of AWS Organizations, AWS Config, AWS CloudTrail, AWS IAM Identity Center, and AWS Service Catalog.
- What it creates
- An organizational structure with a Log Archive account and an Audit account.
- Centralized logging, cross-account audit access, and identity via IAM Identity Center.
- Account Factory — a standardized, self-service way to provision new compliant accounts.
- Controls (formerly guardrails)
- Preventive — implemented as Service Control Policies; the action is blocked outright.
- Detective — implemented as AWS Config rules; the violation is flagged after the fact.
- Proactive — CloudFormation hooks that block non-compliant resources before deployment.
- Not to be confused with
- AWS Organizations — the raw account and policy primitives. Control Tower is the opinionated, prescriptive layer on top.