AWSDOP-C02
On this page
Beginner-friendly overview

Control Tower

Control Tower is AWS's service for setting up and governing a multi-account AWS environment according to best practices. It automates the creation of a landing zone — a pre-configured, secure multi-account structure — and then provides ongoing guardrails to ensure accounts stay compliant as teams use them.

Why Multiple Accounts?

The recommended AWS architecture for organizations of any meaningful size is to use multiple accounts — one for production, one for staging, one per team, one for security/logging, one for shared networking. Separate accounts provide strong isolation: a misconfiguration in the dev account can't affect production, a compromised workload in one account can't access another's resources, and cost is tracked per account.

The challenge is that setting up multiple accounts consistently and securely is complex and repetitive. Control Tower automates this.

What Control Tower Provides

Automated landing zone — Control Tower creates the foundational account structure: a Management account for billing and organization-level policies, a Log Archive account (centralized CloudTrail and Config logs), and an Audit account (read-only access for security teams). You get this secure baseline without configuring each piece manually.

Account Factory — a self-service portal for creating new accounts. When a team needs a new AWS environment, they request one through Account Factory, which provisions a new account pre-configured with your security baseline in minutes. Without Control Tower, creating a new account and configuring all the required services takes days.

Guardrails — pre-built governance rules applied across all accounts. Guardrails are either preventive (implemented as SCPs — they stop non-compliant actions before they happen) or detective (implemented as AWS Config rules — they flag resources that drift from compliance after the fact).

Landing zone: management account on top, guardrails over every OU Management Account Control Tower lives here Preventive guardrail = SCP blocks the action BEFORE it happens Detective guardrail = Config rule flags the violation AFTER the fact Security OU (mandatory) Log Archive all logs, locked Audit security team view Sandbox OU Dev / experiment accounts looser guardrails Workloads OU (custom) Prod account Staging account Guardrails attach at the OU level — every account in the OU, including future ones, inherits them automatically.

Guardrail Examples

Mandatory guardrails are always on: "disallow changes to CloudTrail configuration", "disallow public read access to S3 buckets in the Log Archive account". Optional guardrails you enable based on your policy: "require MFA for IAM user sign-in", "disallow internet gateway creation in new accounts."

The airport mental model — Organizations is the airport, accounts are the planes, and Control Tower is the tower that keeps them flying by the rules.
Preventive guardrail = the locked gate (SCP — the plane never takes off) · Detective guardrail = the radar (Config — spotted after takeoff) · Landing zone = the pre-built airport layout you get on day one · Account Factory = the hangar that rolls out new planes, pre-inspected.

The Relationship to Other Services

Control Tower coordinates several underlying AWS services: Organizations (the account hierarchy), Service Control Policies (preventive guardrails), Config (detective guardrails), CloudTrail (centralized logging), and IAM Identity Center (SSO). Control Tower wires them together into a coherent governance system. Understanding those individual services helps you understand what Control Tower is doing under the hood.