In this video, you’ll see how to use AWS Control Tower to simplify governance in AWS GovCloud Regions.
With this solution, you can set up landing zones and extend governance to your existing GovCloud accounts
by enrolling them individually or in bulk.
Previously, customers could only use AWS Control Tower in standard AWS Regions.
Control Tower is now available in GovCloud Regions as well.
To get started, let’s look at the GovCloud accounts we’ll be using for this demonstration.
For our purposes, we’ve established a multi-account organization in GovCloud.
The management account used to establish the organization
will also be used to manage our landing zone in Control Tower.
We have one member account.
We’ve also created and designated an audit account and a log archive account.
In standard AWS Regions, Control Tower creates these accounts automatically.
In GovCloud Regions, these accounts must be provided.
Now that we’ve seen our accounts,
let’s navigate to AWS Control Tower and set up a landing zone.
A landing zone is a well-architected, multi-account AWS environment
used for governing resources in your existing AWS Organizations infrastructure.
Control Tower helps automate the setup of a new landing zone with best practice blueprints
for identity, federated access, and account structure.
We’ll keep the default Home Region,
which is where we'll manage our landing zone from.
Next, we’ll specify an additional AWS GovCloud Region to govern.
We’ll keep the default name for the Security organizational unit (OU)
that will contain the audit and log accounts.
We can create additional OUs now, or after we set up the landing zone.
We’ll create a secondary OU named Sandbox.
Next, we need to provide the ID for our log archive account.
Let’s return to AWS Organizations to copy it.
We’ll also need to provide the ID for our audit account.
Notice that once we supplied the account IDs,
the account emails and names populated automatically.
To allow Control Tower to manage our AWS CloudTrail logs,
we’ll keep organization-level CloudTrails enabled.
Optionally, we can specify retention times
for the Amazon Simple Storage Service (Amazon S3) logging and access buckets.
We can also configure AWS Key Management Service (KMS) encryption settings.
Now let’s review the landing zone configuration.
Let’s take a closer look at the service permissions.
To launch the landing zone,
Control Tower requires the creation of four AWS Identity and Access Management (IAM) roles.
We can also review the guidance for using Control Tower.
Now let’s acknowledge the notice and finish setting up the landing zone.
Our landing zone is now available.
Let’s explore the dashboard.
The recommended actions show how we can start managing our accounts right away.
The dashboard shows that our environment currently has two organizational units and three accounts,
and there are preventative and detective controls in place.
We can see the specific registered OUs and enrolled accounts.
These are all the controls, or governance rules,
that accounts governed by this landing zone are subject to.
Control Tower Account Factory is not available for GovCloud Regions,
so we can’t vend accounts.
We can, however, extend Control Tower governance to existing accounts through an enrollment process.
Let’s explore the methods for enrolling GovCloud accounts into Control Tower.
The first method is for enrolling individual accounts.
To use this approach,
an execution role must be present in the account before requesting the enrollment.
Let’s quickly create the necessary IAM role.
We’re now logged in to the member account as an admin.
To create the role, let’s navigate to the IAM management console.
We’ll create a custom trust policy.
We can copy the policy we need from the AWS Control Tower User Guide and then paste it here.
Next, we need to make a few modifications to the policy.
First, we’ll provide the management account ID.
The principal is the root user for this account, but since we are in the GovCloud partition,
the trust policy won't work if AWS is in the term.
To fix this, we can use a shorthand notation.
Next, we’ll add the AdministratorAccess policy.
Let’s provide a name and description for the role, and then create it.
Now that we’ve successfully created the execution role for the member account,
let’s switch to the management account and return to Control Tower.
Let’s navigate to the Organization page and enroll the member account.
To complete the enrollment, we must select an OU that is under Control Tower governance.
We’ll select the Sandbox OU that was created when we set up our landing zone.
The prompt warns that we must manually add the AWSControlTowerExecution role to the account,
which we’ve already done,
and that we can only enroll one account at a time.
Let’s proceed with enrolling the account.
The account has been successfully enrolled and is compliant.
Let’s return to the dashboard.
Now let’s look at another method for enrolling accounts into Control Tower.
For our purposes,
a second member account has been added to our organization outside of Control Tower.
First, let’s move this account into an OU that is registered with Control Tower.
We could bring this account into our Sandbox OU,
but in this case, we’ll create another organizational unit.
Let’s create a Production OU.
We’ll select Root as the parent OU.
The new OU has been registered within Control Tower and currently has zero accounts in it.
Now let’s navigate to AWS Organizations and move our second member account into the OU.
The account now appears in the Production OU.
Let’s return to the Organization page in Control Tower to enroll the account.
This OU contains only the second member account we added,
but if it contained multiple accounts, we could enroll them all at once.
To automatically enroll the account, we’ll re-register the OU.
This page shows the risks and expectations for re-registering the OU.
The terms show the estimated time for registration
and warn that we can’t perform any actions on our AWS Control Tower console
after we start the registration process.
We’ll accept the terms and proceed with re-registering the OU.
The OU successfully reregistered,
and the account enrolled in it is now governed by Control Tower.
You’ve just seen how to use AWS Control Tower to simplify governance in AWS GovCloud Regions.
You can learn more about this topic in the description and links for this video.
Thanks for watching.
Now it’s your turn to try.