2.1.1.6. Multi-Account Security: Control Tower & SCPs
2.1.1.6. Multi-Account Security: Control Tower & SCPs
💡 First Principle: Multi-account strategies isolate workloads, simplify billing, and enforce consistent security policies across an organization's AWS environment, preventing broad impact from breaches.
Multi-account strategies are essential for enterprises to achieve security isolation, simplified billing, and efficient governance at scale. Instead of running all workloads in a single AWS account, organizations create multiple accounts, each for a specific purpose (e.g., development, production, logging, security).
- AWS Control Tower: A service that simplifies setting up and governing a secure, compliant multi-account AWS environment. It sets up a well-architected multi-account landing zone and automates the creation of new accounts with pre-configured guardrails, ensuring compliance and security from the outset.
- Service Control Policies (SCPs): A type of organization policy that allows you to manage permissions in your AWS Organization. They define the maximum available permissions for all IAM users and roles in an Organizational Unit (OU) or account. They act as preventative guardrails, preventing specific actions regardless of any other IAM policies.
Key Aspects of Multi-Account Security:
- Isolation: Separate workloads for security.
- Centralized Governance: Manage policies across accounts.
- "Control Tower": Automated landing zone setup, guardrails.
- "SCPs": Preventative maximum permissions.
Details the exam tests:
- SCPs never grant permissions. They only filter: an action must be allowed by the SCPs and by IAM policies. The AWS managed
FullAWSAccessSCP is attached to the root, every OU and every account by default; you restrict by adding Deny statements (deny list) or by replacing it with explicit allows (allow list). - Inheritance: An SCP attached to the root affects every account; one attached to an OU affects only the accounts beneath that OU. SCPs do not restrict the management account.
- Control Tower control behaviors: Preventive controls block disallowed actions (implemented with SCPs or RCPs); detective controls continuously evaluate deployed resources and report noncompliance (implemented with AWS Config rules); proactive controls check resources before they are provisioned (CloudFormation hooks).
- Centralized audit logging: An organization trail, created in the management account (or a delegated administrator account), records CloudTrail events for every member account into one S3 bucket and automatically includes accounts added later.
Scenario: An enterprise uses AWS Control Tower for a secure multi-account landing zone. SCPs within AWS Organization centrally restrict developers from launching non-compliant EC2 instance types across development accounts.
Visual: AWS Multi-Account Structure with Control Tower & SCPs
⚠️ Common Pitfall: Not using multi-account strategies for large organizations, leading to a sprawling, insecure, and hard-to-manage single account.
Key Trade-Offs:
- Centralized Control (SCPs) vs. Decentralized Innovation: SCPs provide strong central control by restricting actions across accounts, which can sometimes be seen as limiting developer autonomy. The trade-off is balancing necessary guardrails with fostering innovation.
Reflection Question: How do multi-account strategies (managed by Control Tower) and Service Control Policies (SCPs) fundamentally enhance security posture beyond individual account configurations, and what are the key benefits of this layered approach?
