AWS Control Tower offers preconfigured groups to organize users that perform specific tasks in your accounts. You can add users and assign them to these groups directly in IAM Identity Center. Doing so matches permission sets to users in groups within your accounts. For the latest guidance and best practices on configuring your groups, see Best practices in the IAM Identity Center User Guide.
The following groups are created when you set up your landing zone.
| Account | Permission sets | Description |
|---|---|---|
| Management account | AWSServiceCatalogEndUserAccess | This group is only used in this account to provision new accounts using Account Factory. |
| Account | Permission sets | Description |
|---|---|---|
| Management account | AWSServiceCatalogAdminFullAccess | This group is only used in this account to make administrative changes to Account Factory. Users in this group can't provision new accounts unless they're also in the AWSAccountFactory group. |
| Account | Permission sets | Description |
|---|---|---|
| Management account | AWSAdministratorAccess | Users of this group in this account are the only ones that have access to the AWS Control Tower console. |
| Log archive account | AWSAdministratorAccess | Users have administrator access in this account. |
| Audit account | AWSAdministratorAccess | Users have administrator access in this account. |
| Member accounts | AWSOrganizationsFullAccess | Users have full access to Organizations in this account. |
| Account | Permission sets | Description |
|---|---|---|
| Management account | AWSPowerUserAccess | Users can perform application development tasks and can create and configure resources and services that support AWS aware application development. |
| Log archive account | AWSPowerUserAccess | Users can perform application development tasks and can create and configure resources and services that support AWS aware application development. |
| Audit account | AWSPowerUserAccess | Users can perform application development tasks and can create and configure resources and services that support AWS aware application development. |
| Member accounts | AWSPowerUserAccess | Users can perform application development tasks and can create and configure resources and services that support AWS aware application development. |
| Account | Permission sets | Description |
|---|---|---|
| Management account | AWSReadOnlyAccess | Users have read-only access to all AWS services and resources in this account. |
| Log archive account | AWSReadOnlyAccess | Users have read-only access to all AWS services and resources in this account. |
| Audit account | AWSReadOnlyAccess | Users have read-only access to all AWS services and resources in this account. |
| Member accounts | AWSReadOnlyAccess | Users have read-only access to all AWS services and resources in this account. |
| Account | Permission sets | Description |
|---|---|---|
| Log archive account | AWSAdministratorAccess | Users have administrator access in this account. |
| Account | Permission sets | Description |
|---|---|---|
| Log archive account | AWSReadOnlyAccess | Users have read-only access to all AWS services and resources in this account. |
| Account | Permission sets | Description |
|---|---|---|
| Audit account | AWSAdministratorAccess | Users have administrator access in this account. |
