AWS Control Tower is a service that helps you set up an automated landing zone using best practices for account management that have been learned from years of working with a variety of customers who have complex multi-account environments. Control Tower is the successor to AWS Landing Zone and relies heavily on AWS Organizations, which will be covered in detail later in this chapter.

In this recipe, you will create a new account to serve as the Control Tower master, and within that account, you will launch your Control Tower environment, which will spawn two additional core accounts: Log Archive and Audit. Then, you will use the AWS Service Catalog to create a new provisioned account. Within a provisioned account, you will attempt to create resources that fail to comply with the guardrails established on the organizational...

In the previous recipe, you used AWS Control Tower to automatically create your landing zone. AWS Control Tower relies on AWS Organizations to manage Organizational Units and Accounts, so it's very important to understand how it works. In this recipe, you will use AWS Organizations to create your own account structure from scratch, starting with a new master account.

All accounts that use AWS Organizations for billing and control purposes must have a master account. This account controls membership to the organization and pays the bills of all the members (someone's got to do it!).

To set up a master account, perform the following steps:

1. Go to the...

Once your organization is up and running, the most common use you will have for it is automating the account creation process. Accounts that are created inside an organization are referred to as member accounts.

All charges that are incurred by a member account will be billed to the master account.

Obviously, you will need an organization to perform this recipe. See the other recipes in this chapter to get started. In this recipe, we will use the CLI instead of the web console. It's good practice to flex your command-line skills now and then since the CLI is such a powerful tool for scripting and automation.

While it makes sense to create new accounts in your organization, what do you do with all the other accounts you have now?

You can invite existing accounts into your organization, which means you can treat them just like a member account from an administrative point of view. This greatly simplifies the administrative overhead of your accounts, as there isn't a separate process for old and new accounts.

As this is generally performed once for each existing account, we will use the console.

You must have enabled AWS Organizations for one of your accounts...

There are a number of ways to group and arrange your AWS accounts. How you do this is completely up to you, but the following are a few examples to consider:

• Business unit (BU) or location: You may wish to allow each BU to work in isolation on its own products or services, on its own schedule, without impacting other parts of the business.
• Cost center: Grouping according to cost may help you track spending versus the allocated budget.
• Environment type: It may make sense to group your development, test, and production environments together in a way that helps you manage the controls across each environment.
• Workload type or data classification: Your company may want to isolate workload types from each other, or ensure that particular controls are applied to all the accounts containing a particular kind of data.

In the following fictitious example, we have...

Before we begin, we should talk about what SCPs are and how they apply to your organization.

An SCP consists of a policy document that defines (by way of filtering) the services and actions that can be used and performed within an OU or in an AWS account.

If you've previously configured an IAM policy, then you will have more than enough background knowledge to get started with SCPs. Apart from a couple of minor exceptions, they look exactly the same.

SCPs can be applied at different levels throughout an organization. The following are the levels, starting from the bottom and going up:

• AWS account level: An SCP that's applied to an AWS account takes effect on only that account. It's important to note that the SCP is very separate from the IAM policies that live inside the account. For example, an SCP might allow full access...

By setting up your accounts with AWS Organizations, you can consolidate your AWS bill so that you are not being charged separately for each of your child accounts. You get one bill for all the accounts and you can easily track the charges from a single place. By combining accounts, you will save money by sharing volume discounts and reserved instance pricing.

All you have to do to enable consolidated billing is create a master account in AWS Organizations (or via Control Tower, as described earlier in this chapter). The master account will be automatically configured to receive the bill for all subordinate accounts. For billing purposes, all accounts will be treated as one account...