📖 What is AWS Control Tower?
AWS Control Tower is a service that provides the easiest way to set up and govern a secure, multi-account AWS environment. It automates the creation of a landing zone based on best practices to ensure consistent governance and compliance.
"If you see 'landing zone' or 'multi-account governance' in a question, Control Tower is the most likely answer."
📚 Certification: AWS Certified Cloud Practitioner (CLF-C02)
🔑 What are the Key Concepts of AWS Control Tower?
- ▸ Automates the creation of a Landing Zone, providing a well-architected, multi-account environment that serves as a secure baseline for all cloud operations.
- ▸ Implements Guardrails, which are pre-defined rules that either prevent non-compliant actions or detect and alert you when resources drift from best practices.
- ▸ Integrates with AWS Organizations to manage account hierarchies, centralized billing, and the application of service control policies across the entire enterprise.
- ▸ Utilizes an Account Factory to standardize the provisioning of new AWS accounts, ensuring every new environment automatically inherits the required security settings.
- ▸ Provides a centralized governance dashboard to monitor the compliance status of all accounts, simplifying the auditing process for regulated industries.
🎯 How does AWS Control Tower appear on the CLF-C02 Exam?
A scenario might describe a company growing rapidly and needing a standardized, automated way to launch new AWS accounts that already include built-in security and compliance rules.
You may be asked to identify the specific service that automates the setup of a multi-account landing zone based on AWS best practices for governance.
Expect questions where a business needs to enforce a set of 'guardrails' across multiple accounts to ensure consistent security policies are maintained globally.
❓ Frequently Asked Questions
How does Control Tower differ from AWS Organizations?
AWS Organizations provides the basic framework for managing multiple accounts and billing. Control Tower builds on top of Organizations to automate the setup of the landing zone and apply governance guardrails.
What is the difference between preventive and detective guardrails?
Preventive guardrails stop an action from occurring using Service Control Policies (SCPs), while detective guardrails use AWS Config to notify you when a resource is created in a non-compliant state.