AWS Control Tower Account Management

Overview

• Four methods for account provisioning in Control Tower:
  • Two console based: Account Factory; enroll account
  • Two automated: Automated account provisioning with IAM roles (e.g. with Lambda); Account Factory for Terraform
• Steps:
  1. Initiate request e.g. Account Factory calls Service Catalog
  2. Service Catalog calls Control Tower
  3. Control Tower workflow—calls AWS Organizations CreateAccount API
  4. Control Tower applies blueprints and Controls
  5. Service Catalog polls Control Tower for progress
  6. When complete—Service Catalog finalizes state and informs requester of result