AWS Security Governance — Control Tower, Org Policies, IaC & Compliance Evidence

#Landing Zone — AWS Control Tower

#What is this?

AWS Control Tower sets up and runs a landing zone: a pre-built multi-account organisation with a management account, a Log Archive account and an Audit (security tooling) account in a Security OU, centralised CloudTrail and Config, IAM Identity Center for sign-in, and a library of guardrails called controls.

#Why it matters

Building all of this by hand takes weeks and drifts. Control Tower makes "every new account starts secure" the default: accounts are vended through Account Factory with logging, guardrails and SSO already attached.

#How it works

Controls come in three kinds, and the exam expects you to match them to the moment they act:

Controls are also graded as mandatory, strongly recommended or elective. Control Tower reports drift when someone changes the landing zone outside it (for example editing a managed SCP directly). Account Factory for Terraform (AFT) and Customizations for Control Tower (CfCT) apply your own baselines to every new account.

📰

Real incident — Code Spaces (2014). One stolen console credential was enough for an attacker to delete a company's servers and its backups, which lived in the same AWS account. The company closed within days. Multi-account landing zones, with backups and logs in accounts that workload credentials can't touch, exist because of incidents like this.

🎯

On the job. Check whether "landing zone" is real: are new accounts actually created through Account Factory, or does someone still create accounts by hand outside the guardrails?

#Security angle

Control Tower is a starting point, not a finish line: its controls cover common misconfigurations, not your workload's threat model. Keep custom SCPs and Config rules in code alongside it.

#Organization Policy Types

#What is this?

AWS Organizations can attach several kinds of policy to the organisation root, an OU (organisational unit) or an account. Each kind governs something different.

#Why it matters

Picking the right policy type is a frequent exam question, and in practice each one closes a gap the others cannot.

#How it works

#Delegated administrators

Security services should not be run from the management account. Instead, register a delegated administrator account (usually the Audit or security tooling account) for GuardDuty, Security Hub, Inspector, Macie, Detective, Config, IAM Access Analyzer, Firewall Manager, Security Lake and IAM Identity Center. The delegated admin enables the service in every account, including new ones, and sees all findings.

#Root user governance

In practiceThe SCP almost every organisation starts with:

{ "Version": "2012-10-17",
  "Statement": [
    { "Sid": "ProtectSecurityServices", "Effect": "Deny",
      "Action": ["cloudtrail:StopLogging", "cloudtrail:DeleteTrail", "guardduty:DeleteDetector",
                 "config:StopConfigurationRecorder", "organizations:LeaveOrganization"],
      "Resource": "*",
      "Condition": { "ArnNotLike": { "aws:PrincipalArn": "arn:aws:iam::*:role/BreakGlass" } } } ] }

And the CloudTrail event to alert on for root use:

{ "eventName": "ConsoleLogin", "userIdentity": { "type": "Root", "arn": "arn:aws:iam::123456789012:root" },
  "sourceIPAddress": "198.51.100.23", "responseElements": { "ConsoleLogin": "Success" } }

🎯

On the job. Test SCPs in a sandbox OU first; an SCP that denies too much at the root can lock out every account, including the people trying to fix it.

#Security angle

The management account is not restricted by SCPs, so anything running there is all-powerful: keep it empty of workloads, few people in it, and every security service delegated elsewhere.

#Deploying Securely and Consistently — IaC and Tagging

#What is this?

Infrastructure as code (IaC) means describing cloud resources in templates (CloudFormation, Terraform) that are reviewed, tested and deployed by a pipeline instead of being clicked together in the console.

#Why it matters

Code can be scanned before it reaches production, every environment is built the same way, and drift from the approved state is detectable.

#How it works

Developer PR ──► cfn-lint (template errors, best practice)
            ──► CloudFormation Guard / Checkov (policy-as-code: "S3 must block public access")
            ──► review + merge
            ──► pipeline deploys with a scoped deployment role
            ──► CloudFormation StackSets push the baseline to every account and region
            ──► Hooks / Config detect anything non-compliant that slipped through

#Security angle

The deployment role is the most powerful identity in the pipeline; it should be assumable only by the pipeline (OIDC federation, no stored keys), and changes to pipeline definitions should need review. See CI/CD security.

#Central Policy Deployment — Firewall Manager, Service Catalog, RAM

#What is this?

Three services for pushing security configuration and approved resources out from a central account.

#Why it matters

Without central deployment, every new account or application is a chance for someone to forget the WAF, open a security group, or build an unapproved architecture.

#How it works

#Security angle

VPC sharing means one account's network team controls the subnets while workload accounts own the instances; security groups stay owned by each workload account, which is easy to forget during an investigation.

#Evaluating Compliance — Config, Security Hub, Audit Manager, Artifact

#What is this?

The services that answer "are we compliant right now, and can we prove it to an auditor?"

#Why it matters

Auditors want evidence collected continuously, not screenshots gathered the week before. Security teams want misconfigurations fixed automatically, not filed as tickets.

#How it works

See compliance frameworks for what SOC 2, ISO 27001 and PCI DSS actually require.

In practiceWhat a non-compliant resource looks like in Config, and the one-line remediation behind it:

$ aws configservice get-compliance-details-by-config-rule --config-rule-name s3-bucket-public-read-prohibited \
    --compliance-types NON_COMPLIANT --query "EvaluationResults[].EvaluationResultIdentifier.EvaluationResultQualifier.ResourceId"
[ "marketing-assets-tmp" ]
# Remediation action attached to the rule: SSM document AWS-DisableS3BucketPublicReadWrite

🎯

On the job. Auditors will ask for evidence that a control operated over the whole period, not just today. Config's timeline and Audit Manager's evidence folders answer "show me this was compliant every day since January" without screenshots.

#Security angle

Automatic remediation can break production (closing a port a service relied on). Auto-remediate high-confidence, low-blast-radius issues, such as public buckets, and route the rest to owners.