Management and Governance
CoreAWS Control Tower
Governed multi-account landing-zone setup and account lifecycle built on AWS Organizations and related services.
Key points
- Control Tower establishes an opinionated landing zone and applies preventive, detective, and proactive controls where supported.
- Account factory and governance workflows reduce manual multi-account setup.
- Controls set boundaries and detect drift; workload roles still need explicit permissions.
Best-known use cases
- Establish a standardized multi-account environment.
- Provision governed accounts with consistent controls.
What candidates often confuse it with
- Control Tower adds landing-zone governance; Organizations provides the underlying accounts, OUs, and SCPs.
- Control Tower governs accounts; IAM Identity Center assigns workforce access.
Key takeaway
Choose Control Tower when a managed landing-zone and account-governance workflow is required.
Related services
- AWS Organizations
- AWS IAM Identity Center
- AWS Service Catalog
Relevant exam tasks
- D1.1