AWS Control Tower & Landing Zones

Control Tower orchestrates a governed multi-account environment

AWS Control Tower provides a prescriptive way to set up and govern a multi-account AWS environment. Its landing zone is built on AWS Organizations and orchestrates supporting services rather than replacing them. Depending on the configured landing-zone capabilities, Control Tower integrates services such as Organizations, IAM Identity Center, CloudTrail, AWS Config and Service Catalog to establish shared governance foundations and central visibility.

This distinction matters when choosing services. Organizations is the lower-level account hierarchy and policy service; Control Tower adds an opinionated landing-zone lifecycle, account enrollment, dashboards, baselines and a catalog of controls around that environment. An organization can exist without Control Tower, and Control Tower can be introduced into a compatible existing organization. The value is standardized governance at scale, not merely a different console for creating accounts.

Controls prevent, detect or proactively reject nonconforming configuration

Control Tower categorizes controls by behavior. Preventive controls stop disallowed actions through policy-based enforcement such as service control policies. Detective controls continuously evaluate deployed resources and surface noncompliance, commonly using AWS Config rules. Proactive controls evaluate resources before provisioning through CloudFormation hook-based mechanisms, rejecting nonconforming resources before they are created or updated through covered CloudFormation operations.

These behaviors solve different timing problems. A detective control can tell you that a deployed resource is out of policy but does not imply that the resource was prevented from existing. A preventive control restricts the action itself. A proactive control validates supported resource configuration at provisioning time. Control coverage also depends on Region, control implementation and governed scope, so operators should verify the exact control reference rather than assuming every control behaves identically everywhere.

• Preventive: policy-enforced restriction before a prohibited action succeeds.
• Detective: evaluates deployed resources and reports policy violations.
• Proactive: checks supported CloudFormation-provisioned resources before deployment completes.

Account Factory standardizes how workload accounts enter the landing zone

Account Factory provides a standardized workflow for provisioning accounts into the Control Tower landing zone with approved configuration. This helps a platform team move from ad hoc account creation toward a repeatable vending process. Newly provisioned or enrolled accounts are placed into the organization structure where the target OU's baselines and controls can apply, so account placement becomes part of security and compliance posture.

Landing-zone lifecycle decisions are deliberately sticky. AWS documents a home Region selected during setup that cannot later be changed, and extending governance to Regions or OUs requires the corresponding landing-zone/account updates. Region selection should therefore match actual workload governance needs. Opting out of a Region does not technically prohibit workloads from being created there; it means those resources can sit outside Control Tower governance unless another control—such as an SCP restricting Region use—also prevents them.