-: Okay, so, let's talk about control tower.
And a control tower is a way to set up a multi-account
AWS environment with the best practices.
And so as such it's going to be automated setup,
we're gonna have policy management,
and a dashboard for visibility.
You don't pay for control tower,
but you're going to pay obviously for all the accounts
and services that are enabled by control tower.
So let's go ahead and set up our landing zone.
And, a landing zone is a way to have multiple accounts.
So, there is shared accounts
and there are three accounts
according to control tower best practices.
We're going to have a master account,
to use your account email right now that you have
and create the selling zone.
And by the way, you don't have to follow along this hands-on
because it's going to show you a lot of things
that you probably don't need,
but I will do it just to demo it to you.
Then we have a log archive account.
So this is an account dedicated to receive logs,
and is best security practice
to separate your master account
and your log archive account, so I can have.
And then an audit account so as...
So I'm just creating different accounts for control tower.
And then for service permissions
we can learn more about permissions right here,
and you can learn more about guidance.
And guidance is how you should manage your accounts
once you've enabled control tower.
So, I'm not going to read it out to you,
but if you do intend to use control tower in your enterprise
please read this guidance because it do provide
very strong guidances around what you can and cannot do,
and what you should and shouldn't do.
And then where you're happy, you say, "Yes, I'm happy,"
and I set up my landing zone.
And this is going to go ahead and set up
all these different accounts on top of your organization,
to get you started with control tower.
So as you can see the setup
is going to take about 60 minutes,
and it's going to take a long time,
it's going to set up two OU,
three shared accounts, a native cloud directory
with pre-configured groups and single sign-on access,
and 20 preventive guardrails to enforce policies
and two detective guardrails
to detect configuration violations.
So, a lot of things are being set up,
I'm just going to wait a little bit until this is done.
Okay, so my landing zone is now available,
and it has set up two things, two organizational units,
three shared accounts with a master accounts
and isolated accounts for log archive and security audits,
there's a native cloud directory with single sign-on access,
and I'll show you this in a second,
and then 20 preventive guardrails to enforce policies
and two detective guardrails
to detect configuration violations.
So, a lot of things was created using control tower,
and if I go to organizations right now,
I can show you right away what was created.
So as we can see here
we have the three accounts already in my organization,
and if I look through organize accounts,
we see there's custom and core organizational units,
so in core we have the audits and archive,
and in the custom we currently have no accounts, okay.
So, we shouldn't manage the account
through organizations though,
we should every time manage the account
through control tower.
And so here are some recommended actions.
So, add or register OUs,
configure your account factory, more guardrails,
and review users and access,
and then review shared accounts.
So, a lot of things are happening here in this dashboard,
we get also access to noncompliant resources
based on the rules that we have defined,
we get some information around the registered OU
that have been created
and whether or not they're compliant so that's perfect,
as well as all the enrolled accounts into my account,
and for the guardrails
we can view all the guardrails right here
if there's only a few guardrails.
And so here we get the information around all the rules
that are enforced on OUs for example.
Disallow the deletion of log archive,
obviously that makes a lot of sense,
disallow public read access to log archive and so on,
disallow configuration changes to CloudTrail,
all these kinda things are excellent to have
and are set up by control tower
according to best practices, okay.
You could always create accounts right here,
so you can view all the accounts here,
and then in the OU you can finish on your OU
and add an OU if you wanted to.
And, here is the guardrails.
The account factory is how you enroll an account
into your control tower which is great.
Users and access, so this is how you manage the user access
to your whole account sets.
So we have single sign-on right here,
and there is a user portal URL right here.
And the way to handle a user identity management right now
is with single sign-on.
It is a service by AWS.
Shared accounts are here,
landing zone settings and so and so,
as you can see this is a full management suite
for multiple accounts.
And so if we go into the SSO portal,
as you can see here there's a second button,
and then there's a password that I have to share,
so I'll just use the password that I have right here
that I've created from before,
and I sign in, and now I am into my SSO,
and I'm able to login into any of my three AWS accounts.
So we have the audit account, the log archive account,
and this defense CCP account
directly accessible from this UI.
So for example, if I want you to go into the audits
I can click here to go into the management console
of this audit account,
or click here for get command line or programmatic access.
So it is really, really neat, and here we go,
I am into my audit account right now.
So, it really shows you the power of control tower,
no, it's not something that you would do on your own
obviously, and now that I've moved away from my accounts
and then to (speaks faintly) my screen but...
This is to show you that yeah, it's quite handy,
I would say so I'm just going to login
back into my CCP account.
It's quite handy to use control tower in your account
to set up multiple accounts that aren't your best practices
and manage it from there.
So, if you are an organization
that wants to have a multiple best practice AWS set up,
then please use control tower.
Okay, that's it, I hope you like this lecture,
and I will see you in the next lecture.