{"id":76571,"date":"2023-01-25T17:11:18","date_gmt":"2023-01-25T17:11:18","guid":{"rendered":"https:\/\/www.globallogic.com\/se\/insights\/%insight%\/deploying-a-landing-zone-with-aws-control-tower-part-1\/"},"modified":"2025-01-20T07:35:15","modified_gmt":"2025-01-20T07:35:15","slug":"deploying-a-landing-zone-with-aws-control-tower-part-1","status":"publish","type":"insightsection","link":"https:\/\/www.globallogic.com\/se\/insights\/blogs\/deploying-a-landing-zone-with-aws-control-tower-part-1\/","title":{"rendered":"Deploying a Landing Zone with AWS Control Tower &#8211; Part 1"},"content":{"rendered":"<div class=\"classic_editor_content\">Welcome to part one of a four-part blog series on AWS Control Tower. This blog provides a step-by-step guide to setting up Control Tower within an AWS Account that is not part of an existing AWS Organisation \u2013\u00a0starting with a short introduction on Landing Zones.<\/p>\n<h4>Landing Zones<\/h4>\n<p>One starting point for many organisations using Public Cloud is the establishment of a Landing Zone. A Landing Zone is a well-architected, multi-account environment that\u2019s based on security and compliance best practices.<\/p>\n<p>There are several reasons why organisations leverage a multi-account strategy including but not limited to:<\/p>\n<ul>\n<li><strong>Service Quotas:<\/strong>\u00a0Each AWS Service typically has different quotas; some of these are soft limits that can be increased by requesting an increase in the limit through a support ticket, whilst others have hard limits that cannot be increased.<\/li>\n<li><strong>Limiting the Blast Radius:<\/strong>\u00a0As an AWS Account is a boundary of isolation, potential risks and threats can be contained within an account without affecting others.<\/li>\n<li><strong>Security Controls:<\/strong>\u00a0Workloads may have different compliance needs based on the industry or the geographical location. Whilst there are synergies between the different compliancy frameworks, the security controls that are implemented to help achieve the compliance may need to be implemented in a slightly different manner or may not be required at all.<\/li>\n<li><strong>Billing Separation:<\/strong>\u00a0AWS Accounts are the only real way to separate items at a billing level e.g., Data Transfer costs.<\/li>\n<\/ul>\n<p>When we first started using AWS in 2016, there was no pre-packaged solution for a Landing Zone; there were several recommendations provided by AWS but in essence it was something that organisations had to build themselves.<\/p>\n<p>The\u00a0<a rel=\"external nofollow\" target=\"_blank\" href=\"https:\/\/aws.amazon.com\/solutions\/implementations\/aws-landing-zone\/\">Landing Zone Implementation<\/a>\u00a0was then developed by several different teams at AWS to help Clients expedite the setup and creation of their Landing Zones through the use of automation. This solution accelerator provided extensible capabilities to manage the most complex and advanced environments. However, one of the downsides was the fact it was not officially supported by AWS Support, meaning that any issues typically required costly engagements with Professional Services or Partners to remediate.<\/p>\n<p>AWS Control Tower came about as the successor to the AWS Landing Zone solution, which is currently in Long-term Support and will not receive any additional features. This, technically was never officially supported by AWS Support. It\u2019s still a relatively new service in AWS Terms having only been made GA in June 2019, although since then it has been enhanced considerably with new features and functionality, as well as being made available in more regions. A key differential of Control Tower is that it is an AWS Managed Service whilst providing parity with the functionality of what the Landing Zone Implementation does.<\/p>\n<p>Prior to setting up Control Tower, there is a dependency on having two unique e-mail addresses that aren\u2019t already associated with an AWS Account. These will be used for creation of the Audit and Log Archive Accounts that Control Tower will provision during the setup. The following section will walk you through the setup of Control Tower within an AWS Account that is not part of an existing AWS Organisation.<\/p>\n<p>Setting up Control Tower<\/p>\n<ul>\n<li>Login to the AWS Management Console using an Account with administrative permissions and switch to the AWS Region that you\u2019re going to use as the Home Region e.g., eu-west-2 (London).<\/li>\n<li>Navigate to the Control Tower Service.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-78911\" src=\"https:\/\/www.globallogic.com\/se\/wp-content\/uploads\/sites\/20\/2023\/07\/setup-part-1-300x161.png\" alt=\"\" width=\"680\" height=\"365\" \/><\/p>\n<ul>\n<li>Click\u00a0<strong>Set up landing zone<\/strong><\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-78912\" src=\"https:\/\/www.globallogic.com\/se\/wp-content\/uploads\/sites\/20\/2023\/07\/setup-part-2a-300x161.png\" alt=\"\" width=\"680\" height=\"365\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-78913\" src=\"https:\/\/www.globallogic.com\/se\/wp-content\/uploads\/sites\/20\/2023\/07\/setup-part-2b-300x161.png\" alt=\"\" width=\"680\" height=\"365\" \/><\/p>\n<ul>\n<li>On the <strong>Review pricing and select Regions<\/strong> page, ensure that the Home Region is set to the region that you want.<\/li>\n<li>Under the <strong>Region deny settings<\/strong> section, click\u00a0<strong>Not enabled<\/strong>. If you wish to change this setting later, it can be easily modified.<\/li>\n<li>Under the <strong>Additional AWS Regions for governance<\/strong> section, leave it as it is for the time being. If you wish to add additional regions to be governed later, it can be easily modified.<\/li>\n<li>Click\u00a0<strong>Next<\/strong><\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-78914\" src=\"https:\/\/www.globallogic.com\/se\/wp-content\/uploads\/sites\/20\/2023\/07\/setup-part-3-300x161.png\" alt=\"\" width=\"682\" height=\"366\" \/><\/p>\n<ul>\n<li>On the <strong>Configure organisational units (OUs)<\/strong> page, click\u00a0<strong>Next<\/strong>.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-78915\" src=\"https:\/\/www.globallogic.com\/se\/wp-content\/uploads\/sites\/20\/2023\/07\/setup-part-4a-300x161.png\" alt=\"\" width=\"689\" height=\"370\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-78916\" src=\"https:\/\/www.globallogic.com\/se\/wp-content\/uploads\/sites\/20\/2023\/07\/setup-part-4b-300x161.png\" alt=\"\" width=\"691\" height=\"371\" \/><\/p>\n<ul>\n<li>On the Configure shared accounts page, Under the Log archive account and Audit account sections enter the corresponding e-mail addresses that you created as a pre-requisite for the deployment and then Click\u00a0<strong>Next<\/strong>.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-78917\" src=\"https:\/\/www.globallogic.com\/se\/wp-content\/uploads\/sites\/20\/2023\/07\/setup-part-5a-300x161.png\" alt=\"\" width=\"650\" height=\"349\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-78918\" src=\"https:\/\/www.globallogic.com\/se\/wp-content\/uploads\/sites\/20\/2023\/07\/setup-part-5b-300x161.png\" alt=\"\" width=\"650\" height=\"349\" \/><\/p>\n<ul>\n<li>On the <strong>Configure CloudTrail and encryption<\/strong> page; under the AWS CloudTrail configuration section, ensure that its set to\u00a0<strong>Enabled<\/strong>.<\/li>\n<li>Under the Log configuration for Amazon S3 section, configure the retention policy as per your requirements.<\/li>\n<li>Under the KMS Encryption section, select\u00a0<strong>Enable and customise encryption settings<\/strong>\u00a0and then click\u00a0<strong>Create a KMS Key<\/strong>.<\/li>\n<\/ul>\n<p>This will now open a new browser tab and start the process of creating a Customer Managed Key.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-78919\" src=\"https:\/\/www.globallogic.com\/se\/wp-content\/uploads\/sites\/20\/2023\/07\/setup-part-6-300x161.png\" alt=\"\" width=\"656\" height=\"352\" \/><\/p>\n<ul>\n<li>On the <strong>Configure key <\/strong>page, click\u00a0<strong>Next<\/strong>.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-78920\" src=\"https:\/\/www.globallogic.com\/se\/wp-content\/uploads\/sites\/20\/2023\/07\/setup-part-7-300x161.png\" alt=\"\" width=\"660\" height=\"354\" \/><\/p>\n<ul>\n<li>On the <strong>Add labels<\/strong> page; under the Alias section, enter an Alias for the CMK. In this case <strong>ControlTowerEncryptionKey<\/strong> has been used.<\/li>\n<li>Under the <strong>Description<\/strong> section, enter a description. In this <strong>Control Tower Encryption Key for CloudTrail<\/strong> has been used.<\/li>\n<li>Click\u00a0<strong>Next<\/strong>.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-78921\" src=\"https:\/\/www.globallogic.com\/se\/wp-content\/uploads\/sites\/20\/2023\/07\/setup-part-8-300x161.png\" alt=\"\" width=\"661\" height=\"355\" \/><\/p>\n<ul>\n<li>On the <strong>Define key administrative permissions<\/strong> page, click\u00a0<strong>Next<\/strong>.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-78922\" src=\"https:\/\/www.globallogic.com\/se\/wp-content\/uploads\/sites\/20\/2023\/07\/setup-part-9-300x161.png\" alt=\"\" width=\"661\" height=\"355\" \/><\/p>\n<ul>\n<li>On the <strong>Define key usage permissions<\/strong> page, click\u00a0<strong>Next<\/strong>.<\/li>\n<li>On the <strong>Review<\/strong> page, click\u00a0<strong>Finish<\/strong>.<\/li>\n<\/ul>\n<p>Switch back to the browser tab with the Control Tower Setup.<\/p>\n<ul>\n<li>Under the <strong>KMS Encryption<\/strong> section, select the KMS CMK that was just created and then click\u00a0<strong>Next<\/strong>.<\/li>\n<li>On the <strong>Review and set up landing zone<\/strong> page, review the configuration settings and click\u00a0<strong>Set up landing zone<\/strong>.<\/li>\n<\/ul>\n<p>Control Tower will then start the process of setting up the Landing Zone and will take approximately 30-45 minutes.<\/p>\n<h4>Coming up\u2026<\/h4>\n<p>Part 2\u00a0of this <a rel=\"external nofollow\" target=\"_blank\" href=\"https:\/\/www.globallogic.com\/insights\/blogs\/deploying-a-landing-zone-with-aws-control-tower-part-2\/\">AWS Control Tower<\/a> walk-through will continue with the initial post-deployment activities within Control Tower including Organisations and Guardrails.<\/p>\n<p>About the author:<\/p>\n<p>Adam Divall, Solutions Architect at GlobalLogic with over 20 years demonstrable experience in design, implementation, migration and support of large, complex solutions to support a customer\u2019s long term business strategy. Divall holds all 12 available certifications for Amazon Web Services with specialisations including Networking, Security, Database, Data Analytics and Machine Learning.<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>This blog provides a step-by-step guide to setting up Control Tower within an AWS Account that is not part of an existing AWS Organisation \u2013\u00a0starting with a short introduction on Landing Zones.<\/p>\n","protected":false},"author":10,"featured_media":78938,"parent":0,"menu_order":67,"template":"","insight":[41],"insight-subcats":[],"insight-industry":[],"insight-services":[],"insight-partners":[799],"class_list":["post-76571","insightsection","type-insightsection","status-publish","has-post-thumbnail","hentry","insight-blogs","insight-partners-aws"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.globallogic.com\/se\/wp-json\/wp\/v2\/insightsection\/76571","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.globallogic.com\/se\/wp-json\/wp\/v2\/insightsection"}],"about":[{"href":"https:\/\/www.globallogic.com\/se\/wp-json\/wp\/v2\/types\/insightsection"}],"author":[{"embeddable":true,"href":"https:\/\/www.globallogic.com\/se\/wp-json\/wp\/v2\/users\/10"}],"version-history":[{"count":1,"href":"https:\/\/www.globallogic.com\/se\/wp-json\/wp\/v2\/insightsection\/76571\/revisions"}],"predecessor-version":[{"id":103304,"href":"https:\/\/www.globallogic.com\/se\/wp-json\/wp\/v2\/insightsection\/76571\/revisions\/103304"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.globallogic.com\/se\/wp-json\/wp\/v2\/media\/78938"}],"wp:attachment":[{"href":"https:\/\/www.globallogic.com\/se\/wp-json\/wp\/v2\/media?parent=76571"}],"wp:term":[{"taxonomy":"insight","embeddable":true,"href":"https:\/\/www.globallogic.com\/se\/wp-json\/wp\/v2\/insight?post=76571"},{"taxonomy":"insight-subcats","embeddable":true,"href":"https:\/\/www.globallogic.com\/se\/wp-json\/wp\/v2\/insight-subcats?post=76571"},{"taxonomy":"insight-industry","embeddable":true,"href":"https:\/\/www.globallogic.com\/se\/wp-json\/wp\/v2\/insight-industry?post=76571"},{"taxonomy":"insight-services","embeddable":true,"href":"https:\/\/www.globallogic.com\/se\/wp-json\/wp\/v2\/insight-services?post=76571"},{"taxonomy":"insight-partners","embeddable":true,"href":"https:\/\/www.globallogic.com\/se\/wp-json\/wp\/v2\/insight-partners?post=76571"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}