The Foundation Before the House
Before understanding the individual components of Control Tower, it helps to understand what a Landing Zone actually is. A Landing Zone is not a single thing — it is a collection of AWS resources, configurations, and policies that together form a secure, governed baseline for your entire AWS presence.
When you enable Control Tower for the first time, it provisions the following automatically:
Core Accounts (created by Control Tower):
- Management Account: The root of your AWS Organization. Used only for billing, governance, and Control Tower administration. You should never run workloads here.
- Log Archive Account: A dedicated account where CloudTrail logs, AWS Config snapshots, and other audit data are shipped from every account in the organization. Access is tightly restricted — even account admins in other accounts cannot delete these logs.
- Audit Account: A read-only account for your security team. It has cross-account read access to every governed account, enabling centralized security review without granting write access.
Core Services Configured:
- AWS Organizations with a root OU and initial child OUs
- AWS SSO (IAM Identity Center) for centralized human access
- AWS CloudTrail organization-wide trail shipping to the Log Archive account
- AWS Config enabled in every account with conformance packs
- Guardrails (SCPs and Config Rules) applied to OUs
The Log Archive and Audit accounts are the most important architectural decision in the entire Landing Zone. They create an immutable audit trail that no workload account administrator can tamper with — a critical requirement for SOC 2, PCI-DSS, and HIPAA compliance.