AWS Control Tower Architecture

Document Control

Field	Details
Project	AWS Control Tower Landing Zone
Version	1.0
Author	Anmol Nagpal
Last updated	2026-07-01

Summary

AWS Control Tower is the governance layer for a secure, compliant, multi-account AWS landing zone. It uses AWS Organizations for account hierarchy, IAM Identity Center for access, AWS Service Catalog for Account Factory, CloudFormation StackSets for baseline rollout, CloudTrail and Config for auditability, and controls for policy enforcement.

This architecture is designed for centralized governance with decentralized workload ownership. Platform administrators own the landing zone, controls, identity model, and shared security services, while workload teams operate inside enrolled accounts that inherit the approved governance baseline.

Architecture Diagram

Landing Zone Structure

Layer	Purpose	Design Notes
Organization root	Parent container for all OUs and accounts	Keep only required organization-wide policies at root. Apply environment-specific controls at OU level where possible.
Management account	Control plane and payer account	Hosts AWS Control Tower administration. Access should be tightly restricted and monitored.
Security OU	Central security and logging boundary	Contains Log Archive and Audit accounts by default. These are shared accounts and should not host workloads.
Log Archive account	Immutable audit log destination	Stores CloudTrail and Config delivery data. Restrict delete access, enable encryption, and retain according to compliance needs.
Audit account	Security review and delegated administrator account	Used for cross-account audit roles and delegated admin services such as GuardDuty and Security Hub.
Shared Services OU	Platform-wide shared services	Optional but recommended for DNS, networking, CI/CD, observability, backup, and artifact services.
Workload OUs	Business or environment workload isolation	Common examples: Development, Test, Staging, Production, Data, Security Tools.
Sandbox OU	Experimentation	Optional OU for short-lived experiments with budget controls and limited privileges.

Core Control Plane Flow

1. AWS Control Tower is configured from the management account.
2. The landing zone setup creates or registers the required organization structure, shared accounts, IAM Identity Center configuration, and mandatory controls.
3. Account Factory provisions accounts using AWS Service Catalog and AWS Organizations.
4. AWS Control Tower assumes AWSControlTowerExecution in enrolled accounts to apply baselines and controls.
5. AWS CloudFormation StackSets deploy AWS Control Tower managed resources across accounts and Regions.
6. CloudTrail and Config record governance events and configuration state.
7. EventBridge receives lifecycle events that can trigger post-provisioning automation.

Account Vending Flow

Step	Service	Description
1	Request channel	Account request is submitted through Account Factory, automation, or an approved platform workflow.
2	AWS Service Catalog	Account Factory standardizes required account parameters and account product lifecycle.
3	AWS Organizations	AWS account is created or enrolled and placed in the target OU.
4	IAM	AWSControlTowerExecution enables Control Tower to baseline and manage the account.
5	AWS Control Tower	Mandatory controls, baselines, logging, and audit roles are applied.
6	CloudFormation StackSets	Required baseline resources are deployed per account and Region.
7	EventBridge	Successful lifecycle events trigger optional automation such as security service enrollment, baseline networking, and notifications.

Governance and Controls

AWS Control Tower controls apply at the OU level and affect accounts inside the OU. The management account is intentionally exempt from controls that could otherwise make the management account unusable; actions in that account should still be tracked through audit logs.

Control Type	Purpose	Example Use
Preventive	Prevent disallowed actions before they happen, commonly through service control policies.	Deny disabling centralized logging in governed accounts.
Detective	Detect resources or configurations that violate policy, commonly through AWS Config rules.	Detect public S3 bucket access or unencrypted resources.
Proactive	Check resources before provisioning when supported.	Validate CloudFormation resources against policy before deployment.

Guidance	Expected Use
Mandatory	Enabled as part of the landing zone baseline.
Strongly recommended	Enable unless a documented exception exists.
Elective	Enable based on workload, compliance, and organizational requirements.

Security Architecture

Security Capability	Account/Location	Implementation Notes
Identity federation	IAM Identity Center	Use permission sets mapped to groups. Integrate with an external IdP when required by client policy.
Break-glass access	Management and security accounts	Maintain tightly controlled emergency access with monitoring and periodic testing.
Central logging	Log Archive account	Centralize CloudTrail and Config logs in encrypted S3 buckets with restricted access.
Security audit	Audit account	Use cross-account audit roles and delegated admin capabilities for visibility.
Threat detection	Audit or security tooling account	Delegate GuardDuty administration and aggregate findings across accounts and Regions.
Security posture	Audit or security tooling account	Delegate Security Hub CSPM and aggregate standards/finding status.
Encryption	S3, KMS, service integrations	Use customer managed keys when required by policy; rotate keys where supported.
Network segmentation	Workload accounts and networking accounts	Use separate VPCs per environment and centralized connectivity patterns as needed.

Observability and Audit Flow

Source	Destination	Purpose
AWS CloudTrail organization activity	Log Archive account	Audit account and API activity across the organization.
AWS Control Tower lifecycle events	CloudTrail, EventBridge, CloudWatch Events	Track completion or failure of landing zone, account, OU, baseline, and control operations.
AWS Config recorders and rules	Account-local Config plus aggregation	Detect resource configuration drift and detective control compliance.
GuardDuty findings	Delegated administrator account	Central threat detection and investigation workflow.
Security Hub findings	Delegated administrator account	Security posture management and standards compliance reporting.

Extension Architecture

Extension Area	Recommended Pattern
Account customization	Trigger automation from Control Tower lifecycle events after account enrollment succeeds.
Baseline infrastructure	Use Terraform, CloudFormation StackSets, or Account Factory customizations for customer-owned resources.
Security services	Use delegated administrator accounts instead of configuring every account manually.
Notifications	Send EventBridge events to SNS, Lambda, or ticketing integrations.
Network baseline	Deploy account VPCs, Transit Gateway attachments, DNS, and routing through controlled infrastructure pipelines.
Policy-as-code	Validate Terraform, CloudFormation, and IAM changes in CI before applying to governed accounts.

Failure and Drift Considerations

Scenario	Impact	Response
Manual edit to AWS Control Tower managed resources	Landing zone or control state may become unknown or drifted.	Reconcile through AWS Control Tower supported update/reset workflows.
Account created outside Account Factory	Account may be unmanaged or missing baselines.	Enroll the account or move it to an unmanaged OU with documented exception.
Failed account provisioning	Account may exist but not be fully baselined.	Review lifecycle events and Account Factory product status; retry supported update/enrollment workflow.
Control enablement failure	OU may not have expected governance coverage.	Review Control Tower activities, CloudFormation StackSets, Config rules, and service-linked roles.
Missing EventBridge automation trigger	Post-provisioning tasks may not run.	Ensure CloudTrail is active and EventBridge rules target the correct event names.

Architecture Decisions

Decision	Rationale
Use Control Tower as the landing zone authority	Provides prescriptive multi-account governance and reduces bespoke account setup.
Keep workloads out of management, Log Archive, and Audit accounts	Reduces blast radius and protects control plane, logging, and security review functions.
Apply controls by OU	Aligns governance with environment risk and account purpose.
Use Account Factory for account vending	Standardizes account creation, enrollment, and baseline application.
Use lifecycle events for automation	Avoids racing against account creation and triggers automation after Control Tower actions complete.
Delegate security services	Centralizes visibility while keeping member accounts manageable.

References

• AWS Control Tower - What is AWS Control Tower?
• AWS Control Tower - How AWS Control Tower works
• AWS Control Tower - Provision and manage accounts with Account Factory
• AWS Control Tower - How AWS Control Tower works with roles
• AWS Control Tower - Lifecycle events
• AWS Control Tower - About controls