AWS Control Tower
Managed service that sets up and governs a secure multi-account AWS environment (landing zone) based on best practices.
Verified against AWS documentation · 2026-08-28
Key facts
- 01Landing zone = the whole governed environment: management account, log archive account, audit account, OUs, and baseline config
- 02Controls (exam may still say "guardrails") come in three types — preventive (SCPs, block the action), detective (Config rules, flag it), proactive (CloudFormation Hooks, catch it before deploy)
- 03Account Factory provisions new accounts pre-baked with your baselines — no hand-configuring each one
- 04Orchestrates other services, it doesn't replace them: Organizations, IAM Identity Center, Config, CloudTrail, CloudFormation StackSets under the hood
- 05Dashboard shows compliance and drift across all enrolled accounts from one place
Exam triggers
Phrases and scenarios that point here.
- "Easiest way to set up and govern a new multi-account environment" → Control Tower
- "Guardrails", "landing zone", "account vending/provisioning at scale" → Control Tower
- Prevent actions across accounts → preventive control; detect non-compliance → detective control
- Restrict which Regions accounts can deploy into → Region deny control
Not this service
- Just need OUs, consolidated billing, and hand-rolled SCPs → AWS Organizations alone
- Curated catalog of approved products for teams to self-serve deploy → Service Catalog
- Rule-level compliance checks in a single account → AWS Config directly
Use cases
- 01A startup graduating from one shared account to per-team accounts — Control Tower stamps out dev, staging, and prod accounts with logging and guardrails already in place
- 02An enterprise where every new project used to mean a week of manual account setup — Account Factory turns it into a self-service vending machine
- 03Compliance teams that need one dashboard answering "which accounts drifted from policy" instead of auditing accounts one by one
- 04Blocking an entire org from launching resources in non-approved Regions (data residency) with one Region deny control
- 05Enrolling messy pre-existing accounts under a single governance baseline instead of retrofitting each by hand
How it's charged
- 01Control Tower itself is free — the bill comes from the services it turns on for you
- 02Main cost drivers: AWS Config (rule evaluations and configuration items), CloudTrail events, and S3 storage for the log archive
- 03Watch out: ephemeral workloads (things spun up and torn down constantly) inflate Config costs, since every resource change is recorded
- 04Account Factory options can create billable resources — e.g. enabling public subnets provisions NAT Gateways you pay for
- 05Organizations and IAM Identity Center pieces stay free; Service Catalog, CloudWatch, SNS, and VPC bill on usage
