Resources created in the service integration accounts
This section shows the resources that AWS Control Tower creates in the service integration accounts, when you set up your landing zone.
For information about member account resources, see Resource Considerations for Account Factory.
Management account resources
When you set up your landing zone, the following AWS resources are created within your management account.
| AWS service | Resource type | Resource name |
|---|---|---|
| AWS Organizations | Accounts | Config aggregator (audit) CloudTrail administrator (log archive) |
| AWS Organizations | OUs | Security Sandbox |
| AWS Organizations | Service Control Policies | aws-guardrails-* |
| AWS CloudFormation | Stacks | AWSControlTowerBP-BASELINE-CLOUDTRAIL-MASTER AWSControlTowerBP-BASELINE-CONFIG-MASTER (in landing zone version 2.6 and later; not deployed in landing zone version 4.0 and later) |
| AWS CloudFormation | StackSets |
AWSControlTowerBP-BASELINE-CLOUDTRAIL (Not deployed in landing zone version 3.0 and later) AWSControlTowerBP-BASELINE-CLOUDWATCH AWSControlTowerBP-BASELINE-CONFIG AWSControlTowerBP-BASELINE-ROLES AWSControlTowerBP-BASELINE-SERVICE-ROLES AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE (Deployed in landing zone version 3.2 and later) AWSControlTowerBP-SECURITY-TOPICS AWSControlTowerLoggingResources AWSControlTowerSecurityResources AWSControlTowerExecutionRole AWSControlTowerBP-CONFIG-CENTRAL-S3-BUCKET (Deployed in landing zone version 4.0 and later) |
| AWS Service Catalog | Product | AWS Control Tower Account Factory |
| AWS Config | Aggregator | aws-controltower-ConfigAggregatorForOrganizations (Not deployed in landing zone version 4.0 and later) |
| AWS CloudTrail | Trail | aws-controltower-BaselineCloudTrail |
| Amazon CloudWatch | CloudWatch Logs | aws-controltower/CloudTrailLogs |
| AWS Identity and Access Management | Roles | AWSControlTowerAdmin AWSControlTowerStackSetRole AWSControlTowerCloudTrailRolePolicy |
| AWS Identity and Access Management | Policies | AWSControlTowerServiceRolePolicy AWSControlTowerAdminPolicy AWSControlTowerCloudTrailRolePolicy AWSControlTowerStackSetRolePolicy |
| AWS IAM Identity Center | Directory groups | AWSAccountFactory AWSAuditAccountAdmins AWSControlTowerAdmins AWSLogArchiveAdmins AWSLogArchiveViewers AWSSecurityAuditors AWSSecurityAuditPowerUsers AWSServiceCatalogAdmins |
| AWS IAM Identity Center | Permission Sets | AWSAdministratorAccess AWSPowerUserAccess AWSServiceCatalogAdminFullAccess AWSServiceCatalogEndUserAccess AWSReadOnlyAccess AWSOrganizationsFullAccess |
Note
The CloudFormation StackSet BP_BASELINE_CLOUDTRAIL is not deployed in landing zone versions 3.0 or later. However, it continues to exist in earlier versions of the landing zone, until you update your landing zone.
As of June 2025, AWS Control Tower deploys detective controls as service-linked AWS Config rules
directly in enrolled accounts, instead of through CloudFormation StackSets. The StackSets
AWSControlTowerGuardrailAWS-GR-AUDIT-BUCKET-PUBLIC-READ-PROHIBITED and
AWSControlTowerGuardrailAWS-GR-AUDIT-BUCKET-PUBLIC-WRITE-PROHIBITED
and their associated stack instances are no longer deployed. For more information, see
Support for detective controls deployed as service-linked AWS Config rules.
CloudTrail administrator account resources
When you set up your landing zone, the following AWS resources are created within your CloudTrail administrator account.
| AWS service | Resource type | Resource Name |
|---|---|---|
| AWS CloudFormation | Stacks |
StackSet-AWSControlTowerBP-BASELINE-CLOUDWATCH- StackSet-AWSControlTowerBP-BASELINE-CONFIG- StackSet-AWSControlTowerBP-BASELINE-CLOUDTRAIL- StackSet-AWSControlTowerBP-BASELINE-SERVICE-ROLES- StackSet-AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE-(In landing zone version 3.2 and later) StackSet-AWSControlTowerBP-BASELINE-ROLES- StackSet-AWSControlTowerLoggingResources- |
| AWS Config | AWS Config Rules | AWSControlTower_AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED AWSControlTower_AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED |
| AWS CloudTrail | Trails | aws-controltower-BaselineCloudTrail |
| Amazon CloudWatch | CloudWatch Event Rules | aws-controltower-ConfigComplianceChangeEventRule |
| Amazon CloudWatch | CloudWatch Logs | /aws/lambda/aws-controltower-NotificationForwarder |
| AWS Identity and Access Management | Roles | aws-controltower-AdministratorExecutionRole aws-controltower-CloudWatchLogsRole aws-controltower-ConfigRecorderRole aws-controltower-ForwardSnsNotificationRole aws-controltower-ReadOnlyExecutionRole AWSControlTowerExecution AWSServiceRoleForAWSControlTower |
| AWS Identity and Access Management | Policies | AWSControlTowerServiceRolePolicy |
| Amazon Simple Notification Service | Topics | aws-controltower-SecurityNotifications |
| AWS Lambda | Applications | StackSet-AWSControlTowerBP-BASELINE-CLOUDWATCH-* |
| AWS Lambda | Functions | aws-controltower-NotificationForwarder |
| Amazon Simple Storage Service | Buckets | aws-controltower-logs-* aws-controltower-s3-access-logs-* |
Config aggregator account resources
When you set up your landing zone, the following AWS resources are created within your Config aggregator account.
| AWS service | Resource type | Resource name |
|---|---|---|
| AWS CloudFormation | Stacks |
StackSet-AWSControlTowerBP-BASELINE-CLOUDWATCH- StackSet-AWSControlTowerBP-BASELINE-CONFIG- StackSet-AWSControlTowerBP-BASELINE-CLOUDTRAIL- StackSet-AWSControlTowerBP-BASELINE-SERVICE-ROLES- StackSet-AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE-(In landing zone version 3.2 and later) StackSet-AWSControlTowerBP-SECURITY-TOPICS- StackSet-AWSControlTowerBP-BASELINE-ROLES- StackSet-AWSControlTowerSecurityResources-* StackSet-AWSControlTowerBP-CONFIG-CENTRAL-S3-BUCKET- (Deployed in landing zone version 4.0 and later) |
| AWS Config | Aggregator | aws-controltower-GuardrailsComplianceAggregator (Not deployed in landing zone version 4.0 and later) |
| AWS Config | Aggregator | aws-controltower-ConfigAggregatorForOrganizations (Deployed in landing zone version 4.0 and later) |
| AWS Config | AWS Config Rules | AWSControlTower_AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED AWSControlTower_AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED |
| AWS CloudTrail | Trail | aws-controltower-BaselineCloudTrail |
| Amazon CloudWatch | CloudWatch Event Rules | aws-controltower-ConfigComplianceChangeEventRule |
| Amazon CloudWatch | CloudWatch Logs | /aws/lambda/aws-controltower-NotificationForwarder |
| AWS Identity and Access Management | Roles | aws-controltower-AdministratorExecutionRole aws-controltower-CloudWatchLogsRole aws-controltower-ConfigRecorderRole aws-controltower-ForwardSnsNotificationRole aws-controltower-ReadOnlyExecutionRole aws-controltower-AuditAdministratorRole aws-controltower-AuditReadOnlyRole AWSControlTowerExecution AWSServiceRoleForAWSControlTower |
| AWS Identity and Access Management | Policies | AWSControlTowerServiceRolePolicy |
| Amazon Simple Notification Service | Topics | aws-controltower-AggregateSecurityNotifications aws-controltower-AllConfigNotifications aws-controltower-SecurityNotifications |
| AWS Lambda | Functions | aws-controltower-NotificationForwarder |
| Amazon Simple Storage Service | Buckets | aws-controltower-config-logs-* (Deployed in landing zone version 4.0 and later) aws-controltower-config-access-logs-* (Deployed in landing zone version 4.0 and later) |
