Standardizing and Automating AWS Account Provisioning

This guide covers the essential strategies and services required to manage multi-account environments at scale, focusing on AWS Control Tower, AWS Organizations, and Infrastructure as Code (IaC) for governance.

Learning Objectives

• Define the components of a secure AWS Landing Zone.
• Automate account creation using the AWS Control Tower Account Factory.
• Implement governance at scale using Service Control Policies (SCPs) and AWS Config.
• Distinguish between Preventive and Detective guardrails.
• Deploy baseline infrastructure across multiple regions using CloudFormation StackSets.

Key Terms & Glossary

• Landing Zone: A well-architected, multi-account AWS environment that is a starting point from which you can deploy workloads and applications.
• Account Factory: A configurable account template in AWS Control Tower that helps standardize the provisioning of new accounts with pre-approved configurations.
• Guardrail: High-level rules for ongoing governance of your AWS environment (e.g., "Disallow public S3 buckets").
• Service Control Policy (SCP): A type of organization policy used to manage permissions in your organization, acting as a filter for what actions IAM users/roles can perform.
• Organizational Unit (OU): A container for accounts within an AWS Organization used to organize accounts and apply policies hierarchically.

The "Big Idea"

In a modern enterprise, managing a single AWS account is insufficient. To maintain security isolation and billing clarity, organizations use hundreds of accounts. The "Big Idea" here is moving away from manual account setup toward an automated vending machine model. By using AWS Control Tower, you treat "Account Provisioning" as a standardized CI/CD process rather than a manual ticketing task.

Formula / Concept Box

Hierarchical Outline

• I. AWS Organizations Core Components
  • Centralized Management: Consolidated billing and account hierarchies.
  • Service Control Policies (SCPs): Define maximum available permissions for an OU or account.
• II. AWS Control Tower & Landing Zones
  • Automated Setup: Deploys a Landing Zone with best-practice blueprints.
  • Account Factory: Leverages AWS Service Catalog to provision new accounts.
  • Mandatory vs. Optional Guardrails: Enforced via SCPs (Preventive) or AWS Config (Detective).
• III. Governance & Security at Scale
  • IAM Identity Center: Centralized SSO for multi-account access.
  • Log Archive & Security Tooling: Centralizing CloudTrail and Config logs into dedicated security accounts.

Visual Anchors

Account Provisioning Flow

Multi-Account Structure

Definition-Example Pairs

• Preventive Guardrail: A policy that strictly forbids an action.
  • Example: An SCP that prevents any user in the "Production" OU from deleting VPC Flow Logs.
• Detective Guardrail: A monitor that alerts you if a policy is violated but does not block the action.
  • Example: An AWS Config rule that flags any S3 bucket that is created without encryption enabled.
• Immutable Infrastructure: The practice of replacing components rather than updating them in place.
  • Example: Instead of patching an OS, you use EC2 Image Builder to create a new AMI and redeploy the account's baseline via a StackSet.

Worked Examples

Task: Provisioning a New "Sandbox" Account with Guardrails

1. Define the OU: Create a "Sandbox" OU in AWS Control Tower.
2. Assign Guardrails: Enable the "Disallow Internet Gateway creation" guardrail for this OU.
3. Launch via Account Factory:
   • Navigate to Control Tower > Account Factory.
   • Enter account details (Email, Account Name, SSO User).
   • Click "Provision Account".
4. Verification: Once the account is "Enrolled", log in as the SSO user. Attempt to create an Internet Gateway. The action should fail with an "Explicit Deny" due to the SCP-based guardrail.

Checkpoint Questions

1. What is the primary difference between a Service Control Policy (SCP) and an IAM Policy?
2. Which service does AWS Control Tower use under the hood to manage the Account Factory templates?
3. If an account is move from OU-A to OU-B, what happens to its inherited guardrails?
4. Why is a "Log Archive" account essential in a Landing Zone architecture?

Muddy Points & Cross-Refs

• SCP vs. IAM Permissions: Remember that SCPs define the maximum possible permissions. If an SCP allows s3:* but the user's IAM policy denies it, the user has NO access. It is an intersection of permissions.
• Control Tower vs. Organizations: Control Tower manages Organizations. You can use Organizations without Control Tower, but you cannot use Control Tower without Organizations.
• Legacy Landing Zones: If you encounter the "AWS Landing Zone" solution (the older, custom SSF-based solution), the modern recommendation is to migrate to AWS Control Tower.

Comparison Tables