# Getting started with AWS Control Tower
<a name="getting-started-with-control-tower"></a>

This getting started procedure is intended for AWS Control Tower administrators. Follow this procedure when you're ready to set up your landing zone using the AWS Control Tower console or APIs. 

If you are an AWS customer currently, but new to AWS Control Tower, you may wish to review the section called [Plan your AWS Control Tower landing zone](planning-your-deployment.md), before you proceed.

**Topics**
+ [

# AWS Control Tower quick start guide
](quick-start.md)
+ [

# Prerequisite: Automated pre-launch checks for your management account
](getting-started-prereqs.md)
+ [

# Setting up your controls dedicated environment
](setting-up-controls-dedicated-environment.md)
+ [

# Get started with AWS Control Tower from the console
](getting-started-from-console.md)
+ [

# Get started with AWS Control Tower using APIs
](getting-started-apis.md)
+ [

# Next steps
](getting-started-next.md)

# AWS Control Tower quick start guide
<a name="quick-start"></a>

If you are new to AWS, you can follow the steps in this section to get started quickly with AWS Control Tower. If you prefer to customize your AWS Control Tower environment right away, see [Step 2. Configure and launch your landing zone](step-two.md).

**Note**  
AWS Control Tower sets up paid services, such as AWS CloudTrail, AWS Config, Amazon CloudWatch, Amazon S3, and Amazon VPC. When used, these services may incur costs, as shown on the [pricing page](https://aws.amazon.com/controltower/pricing/?loc=ft). The AWS management console shows you the usage of any paid services and the costs incurred. No additional costs are created by AWS Control Tower itself.

**Before you begin**

The most important decision to make before you begin the setup process is to *choose your home Region*. Your home Region is the AWS Region in which you'll run most of your workloads or store most of your data. It cannot be changed after you've set up your AWS Control Tower landing zone. For more information about how to choose a home Region, see [Administrative tips for landing zone setup](tips-for-admin-setup.md).

**Note**  
By default, AWS Control Tower chooses the Region in which your account is operating currently as your home Region. You can see your current Region in the upper right of your AWS management console screen.

The quick start procedure assumes that you'll accept the default values for the resources in your AWS Control Tower environment. Many of these choices can be changed later. A few one-time choices are listed in the section called [Expectations for landing zone configuration](getting-started-configure.md).

If you've created a new AWS account, it automatically meets the required prerequisites for setting up AWS Control Tower. You can proceed through the steps that follow.

**Quick start steps**

1. Sign in to the AWS management console with your administrator user credentials. 

1. Navigate to the **AWS Control Tower** console at [https://console.aws.amazon.com/controltower](https://console.aws.amazon.com/controltower).

1. Verify that you are working in your desired home Region.

1. Choose **Set up landing zone**.

1. Follow the instructions in the console, accepting all the default values. You will need to type in the email address for your account, a log archive account, and an audit account.

1. Confirm your choices and choose **Set up landing zone**.

1. AWS Control Tower takes about 30 minutes to set up all of the resources in your landing zone.

For a more detailed version of how to set up AWS Control Tower, including ways to customize your environment, read and follow the procedures in the next few topics.

**Note**  
If you are a first-time customer and you encounter a setup issue, contact [AWS Support](https://aws.amazon.com/premiumsupport/) for diagnostic assistance. 

# Prerequisite: Automated pre-launch checks for your management account
<a name="getting-started-prereqs"></a>

Before AWS Control Tower sets up the landing zone, it automatically runs a series of pre-launch checks in your account. There's no action required on your part for these checks, which ensure that your management account is ready for the changes that establish your landing zone. Here are the checks that AWS Control Tower runs before setting up a landing zone:
+ The existing service limits for the AWS account must be sufficient for AWS Control Tower to launch. For more information, see [Limitations and quotas in AWS Control Tower](limits.md).
+ The AWS account must be subscribed to the following AWS services:
  + Amazon Simple Storage Service (Amazon S3)
  + Amazon Elastic Compute Cloud (Amazon EC2)
  + Amazon SNS
  + Amazon Virtual Private Cloud (Amazon VPC)
  + AWS CloudFormation
  + AWS CloudTrail
  + Amazon CloudWatch
  + AWS Config
  + AWS Identity and Access Management (IAM)
  + AWS Lambda
**Note**  
By default, all accounts are subscribed to these services.

## Considerations for AWS IAM Identity Center (IAM Identity Center) customers
<a name="sso-considerations"></a>
+ If AWS IAM Identity Center (IAM Identity Center) is already set up, the AWS Control Tower home Region must be the same as the IAM Identity Center Region. However, if IAM Identity Center is set up in the US East (N. Virginia) Region (us-east-1), AWS Control Tower uses that instance regardless of the home Region you select.
+ IAM Identity Center can be installed only in the management account of an organization.
+ Three options apply to your IAM Identity Center directory, based on the identity source you choose:
  + **IAM Identity Center User Store**: If AWS Control Tower is set up with IAM Identity Center, AWS Control Tower creates groups in the IAM Identity Center directory and provisions access to these groups, for the user you select, for member accounts.
  + **Active Directory**: If IAM Identity Center for AWS Control Tower is set up with Active Directory, AWS Control Tower does not manage the IAM Identity Center directory. It does not assign users or groups to new AWS accounts.
  + **External Identity Provider**: If IAM Identity Center for AWS Control Tower is set up with an external identity provider (IdP), AWS Control Tower creates groups in the IAM Identity Center directory and provisions access to these groups for the user you select for member accounts. You can specify an existing user from your external IdP in Account Factory during account creation, and AWS Control Tower gives this user access to the newly vended account when it synchronizes users of the same name between IAM Identity Center and the external IdP. You can also create groups in your external IdP to match the names of the default groups in AWS Control Tower. When you assign users to these groups, these users will have access to your enrolled accounts.

   For more information about working with IAM Identity Center and AWS Control Tower see [Things to know about IAM Identity Center accounts and AWS Control Tower](sso.md#sso-good-to-know)

### Considerations for AWS Config and AWS CloudTrail customers
<a name="config-and-cloudtrail-considerations"></a>
+ The AWS account cannot have trusted access enabled in the organization management account for AWS Config. For information about how to disable trusted access, see [the AWS Organizations documentation on how to enable or disable trusted access](https://docs.aws.amazon.com//organizations/latest/userguide/orgs_integrate_services.html#orgs_how-to-enable-disable-trusted-access).
+ If you have an existing AWS Config recorder, delivery channel, or aggregation setup in any existing accounts that you plan to enroll in AWS Control Tower, you must modify or remove these configurations before you start enrolling the accounts, after your landing zone is set up. This pre-check doesn't apply to the AWS Control Tower management account during landing zone launch. For more information, see [Enroll accounts that have existing AWS Config resources](existing-config-resources.md).
+ If you are running ephemeral workloads from accounts in AWS Control Tower, you may see an increase in costs associated with AWS Config. Contact your AWS account representative for more specific information about managing these costs.
+ When you enroll an account into AWS Control Tower, your account is governed by the AWS CloudTrail trail for the AWS Control Tower organization. If you have an existing deployment of a CloudTrail trail in the account, you may see duplicate charges unless you delete the existing trail for the account before you enroll it in AWS Control Tower. For information about organization-level trails and AWS Control Tower, see [Pricing](pricing.md).

**Note**  
When launching, AWS Security Token Service (STS) endpoints must be activated in the management account, for all Regions governed by AWS Control Tower. Otherwise, the launch may fail midway through the configuration process.

# Setting up your controls dedicated environment
<a name="setting-up-controls-dedicated-environment"></a>

 With AWS Control Tower landing zone 4.0, you can now create a controls-only environment without implementing a full landing zone. This deployment option is designed for customers who have an established AWS Organizations setup and want to focus on adopting managed controls through the [The AWS Control Tower Control Catalog](https://docs.aws.amazon.com//controltower/latest/controlreference). 

**Topics**
+ [

# Getting Started
](controls-dedicated-env-getting-started.md)
+ [

# AWS Config Considerations
](controls-dedicated-env-considerations.md)
+ [

# Implementation Process
](controls-dedicated-env-implement.md)
+ [

# Important Notes
](controls-dedicated-env-notes.md)

# Getting Started
<a name="controls-dedicated-env-getting-started"></a>

 Begin by reviewing the AWS Control Tower Control Catalog from the home page to understand available managed controls, their associated compliance frameworks, and control metadata. To enable this experience on AWS Control Tower, select **I have an existing environment and want to enable AWS-managed controls** on the console. You'll then confirm your home region and optionally select additional governed regions. During setup, you can enable automatic account enrollment, which ensures accounts automatically inherit controls and configurations from their parent organizational unit (OU) when moved between OUs. 

# AWS Config Considerations
<a name="controls-dedicated-env-considerations"></a>

 You have the option to enable AWS Config during initial setup or later as needed. AWS Config is required if you plan to use detective controls in your environment. If you choose to enable AWS Config, you'll need to designate an aggregator account to collect configuration and compliance data. You can either select an existing account or create a new one during setup. Additional options include configuring AWS KMS key encryption and specifying Amazon S3 log retention periods for the recording. 

# Implementation Process
<a name="controls-dedicated-env-implement"></a>

 If you proceed without AWS Config, your environment will be immediately ready for preventive and proactive controls within the Control Catalog. 

 However, when you're ready to enable your first detective control, you'll need to enable AWS Config recording through the new `ConfigBaseline` being enabled on the target OUs. This is a one-time setup process per OU and incurs AWS Config pricing based on the number of accounts per OU and resources per account, per AWS Region. 

# Important Notes
<a name="controls-dedicated-env-notes"></a>

 Creating an AWS Control Tower environment establishes a trusted relationship with AWS Organizations, enabling drift detection for preventive controls, and tracking of account and OU changes. During setup, AWS Control Tower creates a landing zone configuration that serves as the foundation for your managed controls environment. 

 To create your controls-dedicated environment via APIs please see: [Get started with AWS Control Tower using APIs](getting-started-apis.md). Note that the manifest field is now optional with landing zone 4.0. 

# Get started with AWS Control Tower from the console
<a name="getting-started-from-console"></a>

This getting started procedure is intended for AWS Control Tower administrators. Follow this procedure when you're ready to set up your landing zone using the AWS Control Tower console. From start to finish, it should take about half an hour. This procedure requires some prerequisites and three main steps.

If you are an AWS customer currently, but new to AWS Control Tower, you may wish to review the section called [Plan your AWS Control Tower landing zone](planning-your-deployment.md), before you proceed.

**Topics**
+ [

# Expectations for landing zone configuration
](getting-started-configure.md)
+ [

# Step 1: Create your shared account email addresses
](step-one.md)
+ [

# Step 2. Configure and launch your landing zone
](step-two.md)
+ [

# Step 3. Review and set up the landing zone
](review-and-set-up.md)

# Expectations for landing zone configuration
<a name="getting-started-configure"></a>

The process of setting up your AWS Control Tower landing zone has multiple steps. Certain aspects of your AWS Control Tower landing zone are configurable. Other choices cannot be changed after setup.

**Key items to configure during setup**
+ You can select your top-level OU names during setup, and you also can change OU names after you've set up your landing zone. By default, the top-level OUs are named **Security** and **Sandbox**. For more information, see [Guidelines to set up a well-architected environment](aws-multi-account-landing-zone.md#guidelines-for-multi-account-setup). 
+ During setup, you can select customized names for the shared accounts that AWS Control Tower creates, called **log archive** and **audit** by default, but you cannot change these names after setup. (This is a one-time selection.)
+ During setup, you can optionally specify existing AWS accounts for AWS Control Tower to use as audit and log archive accounts. If you plan to specify existing AWS accounts, and if those accounts have existing AWS Config resources, you must delete the existing AWS Config resources before you can enroll the accounts into AWS Control Tower. (This is a one-time selection.)
+ If you are setting up for the first time, or if you're upgrading to landing zone version 3.0, you can choose whether to allow AWS Control Tower to set up an organization-level AWS CloudTrail trail for your organization, or you can opt out of trails that are managed by AWS Control Tower and manage your own CloudTrail trails. You can opt into or opt out of organization-level trails that are managed by AWS Control Tower any time you update your landing zone.
+ You can optionally set a customized retention policy for your Amazon S3 log bucket and log access bucket, when you set up or update your landing zone.
+ You can optionally specify a previously-defined *blueprint* to use for provisioning customized member accounts from the AWS Control Tower console. You can customize accounts later if you do not have a blueprint available. See [Customize accounts with Account Factory Customization (AFC)](af-customization-page.md).

**Configuration choices that cannot be undone**
+ You cannot change your home Region after you've set up your landing zone.
+ If you're provisioning Account Factory accounts with VPCs, VPC CIDRs can't be changed after they are created.

# Step 1: Create your shared account email addresses
<a name="step-one"></a>

If you're setting up your landing zone in a new AWS account, see [Setting up](setting-up.md).
+ To set up your landing zone with *new* shared accounts, AWS Control Tower requires two unique email addresses that aren't already associated with an AWS account. Each of these email addresses will serve as a collaborative inbox -- a shared email account -- intended for the various users in your enterprise that will do specific work related to AWS Control Tower.
+ If you are setting up AWS Control Tower for the first time, and if you are bringing existing security and log archive accounts into AWS Control Tower, you can enter the current email addresses of the existing AWS accounts.

The email addresses are required for:
+ **Audit account** – This account is for your team of users that need access to the audit information made available by AWS Control Tower. You can also use this account as the access point for third-party tools that will perform programmatic auditing of your environment to help you audit for compliance purposes.
+ **Log archive account** – This account is for your team of users that need access to all the logging information for all of your enrolled accounts within registered OUs in your landing zone.

These accounts are set up in the **Security** OU when you create your landing zone. As a best practice, we recommend that when you perform actions in these accounts, you should use an IAM Identity Center user with the appropriately scoped permissions.

**Note**  
If you specify existing AWS accounts as your **audit** and **log archive** accounts, the existing accounts must pass some pre-launch checks to ensure that no resources are in conflict with AWS Control Tower requirements. If these checks are not successful, your landing zone setup may not succeed. In particular, the accounts must not have existing AWS Config resources. For more information, see [Considerations for bringing existing security or logging accounts](accounts.md#considerations-for-existing-shared-accounts).

For the sake of clarity, this *User Guide* always refers to the shared accounts by their default names: **log archive** and **audit**. As you read this document, remember to substitute the customized names you give to these accounts initially, if you choose to customize them. You can view your accounts with their customized names on the **Account details** page.

**Note**  
We are changing our terminology regarding the default names of some AWS Control Tower organizational units (OUs) to align with the AWS multi-account strategy. You may notice some inconsistencies while we are making a transition to improve the clarity of these names. The Security OU was formerly called the Core OU. The Sandbox OU was formerly called the Custom OU.

# Step 2. Configure and launch your landing zone
<a name="step-two"></a>

Before you launch your AWS Control Tower landing zone, determine the most appropriate home Region. For more information, see [Administrative tips for landing zone setup](tips-for-admin-setup.md).

**Important**  
Changing your home Region after you have deployed your AWS Control Tower landing zone requires decommissioning as well as the assistance of AWS Support. This practice is not recommended.

Learn how to configure and launch your landing zone using the AWS CLI in [Get started with AWS Control Tower using APIs](getting-started-apis.md). 

To configure and launch your landing zone in the console, perform the following series of steps.

**Prepare: Navigate to the AWS Control Tower console**

1. Open a web browser, and navigate to the AWS Control Tower console at [https://console.aws.amazon.com/controltower](https://console.aws.amazon.com/controltower).

1. In the console, verify that you are working in your desired home Region for AWS Control Tower. Then choose **Set up your landing zone**.

# Step 2a. Review and select your AWS Regions
<a name="pricing-and-regions"></a>

Be sure you've correctly designated the AWS Region that you select for your home Region. After you've deployed AWS Control Tower, you can't change the home Region.

In this section of the setup process, you can add any additional AWS Regions that you require. You can add more Regions at a later time, if needed, and you can remove Regions from governance.

**To select additional AWS Regions to govern**

1. The panel shows you the current Region selections. Open the dropdown menu to see a list of additional Regions available for governance.

1. Check the box next to each Region to bring into governance by AWS Control Tower. Your home Region selection is not editable.

**To deny access to certain Regions**

To deny access to AWS resources and workloads in certain AWS Regions, select **Enabled** in the section for the Region deny control. By default, the setting for this control is **Not enabled**.

# Step 2b. Configure your organizational units (OUs)
<a name="configure-ous"></a>

If you accept the default names of these OUs, there's no action you need to take for setup to continue. To change the names of the OUs, enter the new names directly in the form field.
+ **Foundational OU** – AWS Control Tower relies upon a **Foundational OU** that is initially named the **Security OU**. You can change the name of this OU during initial setup and afterward, from the OU details page. This **Security OU** contains your two shared accounts, which by default are called the **log archive** account and the **audit** account.
+ **Additional OU** – AWS Control Tower can set up one or more **Additional OUs** for you. We recommend that you provision at least one **Additional OU** in your landing zone, besides the **Security OU**. If this Additional OU is intended for development projects, we recommend that you name it the **Sandbox OU**, as given in the [Guidelines to set up a well-architected environment](aws-multi-account-landing-zone.md#guidelines-for-multi-account-setup). If you already have an existing OU in AWS Organizations, you may see the option to skip setting up an Additional OU in AWS Control Tower. 

# Step 2c. Configure your shared accounts, logging, and encryption
<a name="configure-shared-accounts"></a>

In this section of the setup process, the panel shows the default selections for the names of your shared AWS Control Tower accounts. These accounts are an essential part of your landing zone. **Do not move or delete these shared accounts**. You can choose customized names for the **audit** and **log archive** accounts during setup. Alternatively, you have a one-time option to specify existing AWS accounts as your shared accounts.

You must provide unique email addresses for your log archive and audit accounts, and you can verify the email address that you previously provided for your management account. Choose the **Edit** button to change the editable default values.

**About the shared accounts**
+ **The management account** – The AWS Control Tower management account is part of the Root level. The management account allows for AWS Control Tower billing. The account also has administrator permissions for your landing zone. You cannot create separate accounts for billing and for administrator permissions in AWS Control Tower.

  The email address shown for the management account is not editable during this phase of setup. It is shown as a confirmation, so you can check that you're editing the correct management account, in case you have multiple accounts.
+  **The two shared accounts** – You can choose customized names for these two accounts, or bring your own accounts, and you must supply a unique email address for each account, either new or existing. If you choose to have AWS Control Tower create new shared accounts for you, the email addresses must not already have associated AWS accounts.

**To configure the shared accounts, fill in the requested information.**

1. At the console, enter a name for the account initially called the **log archive** account. Many customers decide to keep the default name for this account.

1. Provide a unique email address for this account.

1. Enter a name for the account initially called the **audit** account. Many customers choose to call it the **Security** account.

1. Provide a unique email address for this account.

# Optionally configure log retention
<a name="configure-log-retention"></a>

During this phase of setup, you can customize the log retention policy for Amazon S3 buckets that store your AWS CloudTrail logs in AWS Control Tower, in increments of days or years, up to a maximum of 15 years. If you choose not to customize your log retention, the default settings are one year for standard account logging and 10 years for access logging. This feature also is available when you update or reset your landing zone.

# Optionally self-manage AWS account access
<a name="select-idp"></a>

You can select whether AWS Control Tower sets up AWS account access with AWS Identity and Access Management (IAM), or whether to self-manage AWS account access—either with AWS IAM Identity Center users, roles, and permissions that you can set up and customize on your own, or with another method *such as an external IdP, either for direct account federation or federation to multiple accounts by means of IAM Identity Center*. You can change this selection later.

By default, AWS Control Tower sets up AWS IAM Identity Center for your landing zone, in alignment with best-practices guidance defined in [Organizing your AWS environment using multiple accounts](https://docs.aws.amazon.com//whitepapers/latest/organizing-your-aws-environment/organizing-your-aws-environment.html). Most customers choose the default. Alternative access methods are required sometimes, for regulatory compliance in specific industries or countries, or in AWS Regions where AWS IAM Identity Center is not available.

Selection of identity providers at the account level is not supported. This option applies only for the landing zone as a whole.

For more information, see [IAM Identity Center guidance](sso-guidance.md).

# Optionally configure AWS CloudTrail trails
<a name="configure-org-trails"></a>

As a best practice, we recommend that you set up logging. If you wish to allow AWS Control Tower to set up an organization-level CloudTrail trail and manage it for you, choose **Opt in**. If you wish to manage logging with your own CloudTrail trails or a third-party logging tool, choose **Opt out**. Confirm your selection when requested to do so in the console. You can change your selection, and opt into, or opt out of, organization-level trails when you update your landing zone.

You can set up and manage your own CloudTrail trails at any time, including organization-level and account-level trails. If you set up duplicate CloudTrail trails, you may incur duplicate costs when CloudTrail events are logged.

# Optionally configure AWS KMS keys
<a name="configure-kms-keys"></a>

If you wish to encrypt and decrypt your resources with an AWS KMS encryption key, select the checkbox. If you have existing keys, you'll be able to select them from identifiers displayed in a dropdown menu. You can generate a new key by choosing **Create a key**. You can add or change a KMS key any time you update your landing zone.

When you select **Set up landing zone**, AWS Control Tower performs a pre-check to validate your KMS key. The key must meet these requirements:
+ Enabled
+ Symmetric
+ Not a multi-Region key
+ Has correct permissions added to the policy
+ Key is in the management account

You may see an error banner if the key does not meet these requirements. In that case, choose another key or generate a key. Be sure to edit the key's permissions policy, as described in the next section.

## Update the KMS key policy
<a name="kms-key-policy-update"></a>

 Before you can update a KMS key policy, you must create a KMS key. For more information, see [Creating a key policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html) in the *AWS Key Management Service Developer Guide*. 

 To use a KMS key with AWS Control Tower, you must update the default KMS key policy by adding the minimum required permissions for AWS Config and AWS CloudTrail. As a best practice, we recommend that you include the minimum required permissions in any policy. When updating a KMS key policy, you can add permissions as a group in a single JSON statement or line by line. 

 The procedure describes how to update the default KMS key policy in the AWS KMS console by adding policy statements that allow AWS Config and CloudTrail to use AWS KMS for encryption. The policy statements require that you include the following information: 
+  **`YOUR-MANAGEMENT-ACCOUNT-ID`** – the ID of the management account in which AWS Control Tower will be set up. 
+  **`YOUR-HOME-REGION`** – the home Region that you will select when setting up AWS Control Tower. 
+  **`YOUR-KMS-KEY-ID`** – the KMS key ID that will be used with the policy. 

**To update the KMS key policy**

1.  Open the AWS KMS console at [https://console.aws.amazon.com//kms](https://console.aws.amazon.com//kms)

1.  From the navigation pane, choose **Customer managed keys**. 

1.  In the table, select the key that you want to edit. 

1.  In the **Key policy** tab, make sure that you can view the key policy. If you can't view the key policy, choose **Switch to policy view**. 

1.  Choose **Edit**, and update the default KMS key policy by adding the following policy statements for AWS Config and CloudTrail. 

    **AWS Config policy statement** 

   ```
   {
       "Sid": "Allow Config to use KMS for encryption",
       "Effect": "Allow",
       "Principal": {
           "Service": "config.amazonaws.com"
       },
       "Action": [
           "kms:Decrypt",
           "kms:GenerateDataKey"
       ],
       "Resource": "arn:aws:kms:YOUR-HOME-REGION:YOUR-MANAGEMENT-ACCOUNT-ID:key/YOUR-KMS-KEY-ID"
   }
   ```

    **CloudTrail policy statement** 

   ```
   {
       "Sid": "Allow CloudTrail to use KMS for encryption",
       "Effect": "Allow",
       "Principal": {
           "Service": "cloudtrail.amazonaws.com"
       },
       "Action": [
           "kms:GenerateDataKey*",
           "kms:Decrypt"
       ],
       "Resource": "arn:aws:kms:YOUR-HOME-REGION:YOUR-MANAGEMENT-ACCOUNT-ID:key/YOUR-KMS-KEY-ID",
       "Condition": {
           "StringEquals": {
               "aws:SourceArn": "arn:aws:cloudtrail:YOUR-HOME-REGION:YOUR-MANAGEMENT-ACCOUNT-ID:trail/aws-controltower-BaselineCloudTrail"
           },
           "StringLike": {
               "kms:EncryptionContext:aws:cloudtrail:arn": "arn:aws:cloudtrail:*:YOUR-MANAGEMENT-ACCOUNT-ID:trail/*"
           }
       }
   }
   ```

1.  Choose **Save changes**. 

 ** Example KMS key policy ** 

 The following example policy shows what your KMS key policy might look like after you add the policy statements that grant AWS Config and CloudTrail the minimum required permissions. The example policy doesn't include your default KMS key policy. 

```
{
    "Version": "2012-10-17",		 	 	 
    "Id": "CustomKMSPolicy",
    "Statement": [
        {
        ... YOUR-EXISTING-POLICIES ...
        },
        {
            "Sid": "Allow Config to use KMS for encryption",
            "Effect": "Allow",
            "Principal": {
                "Service": "config.amazonaws.com"
            },
            "Action": [
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "arn:PARTITION:kms:YOUR-HOME-REGION:YOUR-MANAGEMENT-ACCOUNT-ID:key/YOUR-KMS-KEY-ID"
        },
        {
            "Sid": "Allow CloudTrail to use KMS for encryption",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudtrail.amazonaws.com"
            },
            "Action": [
                "kms:GenerateDataKey*",
                "kms:Decrypt"
              ],
            "Resource": "arn:PARTITION:kms:YOUR-HOME-REGION:YOUR-MANAGEMENT-ACCOUNT-ID:key/YOUR-KMS-KEY-ID",
            "Condition": {
                "StringEquals": {
                    "aws:SourceArn": "arn:PARTITION:cloudtrail:YOUR-HOME-REGION:YOUR-MANAGEMENT-ACCOUNT-ID:trail/aws-controltower-BaselineCloudTrail"
                },
                "StringLike": {
                    "kms:EncryptionContext:aws:cloudtrail:arn": "arn:PARTITION:cloudtrail:*:YOUR-MANAGEMENT-ACCOUNT-ID:trail/*"
                }
            }
        }
    ]
}
```

 To view other example policies, see the following pages: 
+  [Granting encrypt permissions](https://docs.aws.amazon.com//awscloudtrail/latest/userguide/create-kms-key-policy-for-cloudtrail.html#create-kms-key-policy-for-cloudtrail-encrypt) in the *AWS CloudTrail User Guide*. 
+  [Required Permissions for the KMS Key When Using Service-Linked RolesS3 Bucket Delivery)](https://docs.aws.amazon.com//config/latest/developerguide/s3-kms-key-policy.html#required-permissions-s3-kms-key-using-servicelinkedrole) in the *AWS Config Developer Guide*. 

**Protect against attackers**  
 By adding certain conditions to your policies, you can help prevent a specific type of attack, known as a *confused deputy* attack, which occurs if an entity coerces a more-privileged entity to perform an action, such as with cross-service impersonation. For general information about policy conditions, also see [Specifying conditions in a policy](access-control-overview.md#specifying-conditions).

The AWS Key Management Service (AWS KMS) allows you to create multi-Region KMS keys and asymmetric keys; however, AWS Control Tower does not support multi-Region keys or asymmetric keys. AWS Control Tower performs a pre-check of your existing keys. You may see an error message if you select a multi-Region key or an asymmetric key. In that case, generate another key for use with AWS Control Tower resources.

For more information about AWS KMS, see [ the AWS KMS Developer Guide.](https://docs.aws.amazon.com//kms/latest/developerguide/overview.html)

Note that customer data in AWS Control Tower is encrypted at rest, by default, using SSE-S3.

# Optionally configure auto-enrollment for accounts
<a name="configure-auto-enroll"></a>

When you enable this feature during setup, or later, accounts that are moved between two registered OUs, or moved into your AWS Control Tower environment for the first time, no longer show a state of inheritance drift. The accounts automatically inherit the baselines and controls that are enabled on the new OU. Controls and baselines from the previous OU are removed.

To opt in for auto-enrollment at any time after setup, navigate to the landing zone **Settings** page and choose **Update** landing zone, or call the AWS Control Tower `UpdateLandingZone` API.

You can move an account between OUs by means of the AWS Organizations API, or by means of the AWS Control Tower console. If you move an account outside an OU that's registered, AWS Control Tower removes all deployed baselines and controls, automatically. It essentially unenrolls the account from AWS Control Tower.

**Note**  
If you choose to enable the auto-enroll capability after initial setup of the landing zone, AWS Control Tower does not retroactively resolve the inheritance drift that was caused by moving accounts between OUs before the auto-enroll capability was enabled. The automatic drift resolution goes into effect for accounts that are moved after you enable this setting.

# Optionally configure and create customized member accounts
<a name="configure-customized-accounts"></a>

When you follow the **Create account** workflow to add your member accounts, you can optionally specify a previously-defined *blueprint* to use for provisioning customized member accounts from the AWS Control Tower console. You can customize accounts later if you do not have a blueprint available. See [Customize accounts with Account Factory Customization (AFC)](af-customization-page.md). 

# Step 3. Review and set up the landing zone
<a name="review-and-set-up"></a>

The next section in the setup shows you the permissions that AWS Control Tower requires for your landing zone. Choose a checkbox to expand each topic. You'll be asked to agree to these permissions, which may affect multiple accounts, and to agree to the overall **Terms of Service**.

**To finalize**

1. At the console, review the **Service permissions**, and when you're ready, choose **I understand the permissions AWS Control Tower will use to administer AWS resources and enforce rules on my behalf**.

1. To finalize your selections and initialize launch, choose **Set up landing zone**.

This series of steps starts the process of setting up your landing zone, which can take about thirty minutes to complete. During setup, AWS Control Tower creates your Root level, the Security OU, and the shared accounts. Other AWS resources are created, modified, or deleted.

**Confirm SNS subscriptions**  
The email address you provided for the audit account will receive **AWS Notification – Subscription Confirmation** emails from every AWS Region supported by AWS Control Tower. To receive compliance emails in your audit account, you must choose the **Confirm subscription** link within each email from each AWS Region supported by AWS Control Tower. 

# Get started with AWS Control Tower using APIs
<a name="getting-started-apis"></a>

This getting started procedure is intended for AWS Control Tower administrators. This procedure requires some prerequisites and includes two main steps. 

In this procedure, you will use APIs from AWS Control Tower and other AWS services to configure and launch a landing zone. These APIs allow you to create a AWS Control Tower environment programatically, either [through the CloudFormation console](lz-apis-cfn.md), or through the AWS CLI. 

Before you launch your AWS Control Tower landing zone, perform these prerequisite tasks: 
+ Determine the most appropriate home Region. For more information, see [Administrative tips for landing zone setup](tips-for-admin-setup.md). 
+ Review [Prerequisite: Automated pre-launch checks for your management account](getting-started-prereqs.md) to learn about the automated pre-launch checks that make sure your management account is ready for changes that establish your landing zone. 

**Topics**
+ [

# Expectations for landing zone configuration with APIs
](getting-started-expectations-api.md)
+ [

# Step 1: Configure your landing zone
](lz-api-prereques.md)
+ [

# Step 2: Launch your landing zone using the AWS Control Tower APIs
](lz-api-launch.md)
+ [

# Identify your landing zone
](lz-api-list.md)
+ [

# Update your landing zone
](lz-api-update.md)
+ [

# Reset the landing zone to resolve drift
](lz-api-reset.md)
+ [

# View the details of your landing zone manifest file
](lz-manifest-file.md)
+ [

# View the status of your landing zone operations
](lz-api-examples-short.md)
+ [

# Examples: Set up an AWS Control Tower landing zone with APIs only
](walkthrough-api-setup.md)
+ [

# Landing zone schemas
](landing-zone-schemas.md)
+ [

# Launch a landing zone using CloudFormation
](lz-apis-cfn.md)

# Expectations for landing zone configuration with APIs
<a name="getting-started-expectations-api"></a>

The process of setting up your AWS Control Tower landing zone has multiple steps. Certain aspects of your AWS Control Tower landing zone are configurable. Other choices cannot be changed after setup.

**Key items to configure during setup**
+ You can select your Foundational OU names during setup, and you also can change OU names after you've set up your landing zone. By default, the Foundational OUs are named **Security** and **Sandbox**. For more information, see [Guidelines to set up a well-architected environment](aws-multi-account-landing-zone.md#guidelines-for-multi-account-setup). 
+ During setup, you can select customized names for the shared accounts that AWS Control Tower creates, called **log archive** and **audit** by default, but you cannot change these names after setup. (This is a one-time selection.)
+ During setup with APIs, you *must* specify existing AWS accounts for AWS Control Tower to use as audit and log archive accounts. To specify existing AWS accounts, if those accounts have existing AWS Config resources, you must delete or modify the existing AWS Config resources before you can enroll the accounts into AWS Control Tower. (This is a one-time selection.) 
+ If you are setting up for the first time, or if you're upgrading to landing zone version 3.0, you can choose whether to allow AWS Control Tower to set up an organization-level AWS CloudTrail trail for your organization, or you can opt out of trails that are managed by AWS Control Tower and manage your own CloudTrail trails. You can opt into or opt out of organization-level trails that are managed by AWS Control Tower any time you update your landing zone.
+ You can optionally set a customized retention policy for your Amazon S3 log bucket and log access bucket, when you set up or update your landing zone.

**Configuration choices that cannot be undone**
+ You cannot change your home Region after you've set up your landing zone.
+ If you're provisioning accounts with VPCs, VPC CIDRs can't be changed after they are created.

The next sections give the setup prerequisites and steps in detail, with explanations and caveats. For additional code examples, see [Examples: Set up an AWS Control Tower landing zone with APIs only](walkthrough-api-setup.md). 

# Step 1: Configure your landing zone
<a name="lz-api-prereques"></a>

 The process of setting up your AWS Control Tower landing zone has multiple steps. Certain aspects of your AWS Control Tower landing zone are configurable, but other choices cannot be changed after setup. To learn more about these important considerations prior to launching your landing zone, review [Expectations for landing zone configuration](getting-started-configure.md). 

 Before using the AWS Control Tower landing zone APIs, you must first call APIs from other AWS services to configure your landing zone prior to launch. The process includes three main steps: 

1. creating a new AWS Organizations organization,

1. setting up your service integration accounts,

1. and creating an IAM role or IAM Identity Center user with the required permissions to call the landing zone APIs.

## Step 1. Create the organization that will contain your landing zone:
<a name="w2aac15c17c15b9"></a>

 Call the AWS Organizations `CreateOrganization` API and enable all features to create the **Foundational OU**. AWS Control Tower also recommends creating a designated **Security OU**. This Security OU should contain all of your service integration accounts. These would be the **log archive** account and the **audit** account for previous Landing Zone versions. 

```
aws organizations create-organization --feature-set ALL
```

 AWS Control Tower can set up one or more **Additional OUs**. We recommend that you provision at least one Additional OU in your landing zone, besides the Security OU. If this Additional OU is intended for development projects, we recommend that you name it the **Sandbox OU**, as given in the [AWS multi-account strategy for your AWS Control Tower landing zone](aws-multi-account-landing-zone.md). 

## Step 2. Provision service integration accounts if needed:
<a name="w2aac15c17c15c11"></a>

 To set up your landing zone, AWS Control Tower allows customers to configure AWS service integrations. Each of these service integrations may require one or more service integration central accounts. If you are using landing zone APIs to set up AWS Control Tower for the first time, you must provide the central integration account for each enabled AWS service integration. You can use existing AWS accounts or provision these accounts through the AWS Control Tower console or AWS Organizations APIs. **Ensure these service integration accounts are in the designated Security OU that is at the root level in your organization.** 

1. Call the AWS Organizations `CreateAccount` API to create the **Log archive** account and **Audit** account in the **Security OU**.

   ```
                               aws organizations create-account --email mylog@example.com --account-name "Logging Account"
                               aws organizations create-account --email mysecurity@example.com --account-name "Security Account"
   ```

    (Optional) Check the status of the `CreateAccount` operation using the AWS Organizations `DescribeAccount` API. 

1. Move the provisioned service integration accounts into the designated **Security OU**

   ```
                               aws organizations move-account --account-id 0123456789012 --source-parent-id r-examplerootid111 --destination-parent-id ou-examplerootid111-security
   ```

## Step 3. Create the required service roles
<a name="w2aac15c17c15c13"></a>

 Create the following IAM service roles in the `/service-role/` IAM path that enable AWS Control Tower to perform the API calls required to set up your landing zone: 
+  [https://docs.aws.amazon.com//controltower/latest/userguide/access-control-managing-permissions.html#AWSControlTowerAdmin](https://docs.aws.amazon.com//controltower/latest/userguide/access-control-managing-permissions.html#AWSControlTowerAdmin) 
+  [https://docs.aws.amazon.com//controltower/latest/userguide/access-control-managing-permissions.html#AWSControlTowerCloudTrailRole](https://docs.aws.amazon.com//controltower/latest/userguide/access-control-managing-permissions.html#AWSControlTowerCloudTrailRole) 
+  [https://docs.aws.amazon.com//controltower/latest/userguide/access-control-managing-permissions.html#AWSControlTowerStackSetRole](https://docs.aws.amazon.com//controltower/latest/userguide/access-control-managing-permissions.html#AWSControlTowerStackSetRole) 
+  [https://docs.aws.amazon.com//controltower/latest/userguide/roles-how.html#config-role-for-organizations](https://docs.aws.amazon.com//controltower/latest/userguide/roles-how.html#config-role-for-organizations) 

 For more information about these roles and their policies, see [Using identity-based policies (IAM policies) for AWS Control Tower](access-control-managing-permissions.md). 

### To create an IAM role:
<a name="w2aac15c17c15c13b9"></a>

 Create an IAM role with the necessary permissions to call all landing zone APIs. Alternatively, you can create an IAM Identity Center user and assign the necessary permissions. 

```
{
    "Version": "2012-10-17",		 	 	                    
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "backup:UpdateGlobalSettings",
                "controltower:CreateLandingZone",
                "controltower:UpdateLandingZone",
                "controltower:ResetLandingZone",
                "controltower:DeleteLandingZone",
                "controltower:GetLandingZoneOperation",
                "controltower:GetLandingZone",
                "controltower:ListLandingZones",
                "controltower:ListLandingZoneOperations",
                "controltower:ListTagsForResource",
                "controltower:TagResource",
                "controltower:UntagResource",
                "servicecatalog:*",
                "organizations:*",
                "organizations:RegisterDelegatedAdministrator",
                "organizations:EnableAWSServiceAccess",
                "organizations:DeregisterDelegatedAdministrator",
                "organizations:ListDelegatedAdministrators",
                "sso:*",
                "sso-directory:*",
                "logs:*",
                "cloudformation:*",
                "kms:*",
                "iam:GetRole",
                "iam:CreateRole",
                "iam:GetSAMLProvider",
                "iam:CreateSAMLProvider",
                "iam:CreateServiceLinkedRole",
                "iam:ListRolePolicies",
                "iam:PutRolePolicy",
                "iam:ListAttachedRolePolicies",
                "iam:AttachRolePolicy",
                "iam:DeleteRole",
                "iam:DeleteRolePolicy",
                "iam:DetachRolePolicy"
            ],
            "Resource": "*"
        }
    ]
}
```

**Note**  
 When upgrading to landing zone version 4.0 with AWS Config integration enabled, customers need to have `organizations:ListDelegatedAdministrators` permissions. 

# Step 2: Launch your landing zone using the AWS Control Tower APIs
<a name="lz-api-launch"></a>

 You can use AWS Control Tower APIs to launch your landing zone. This section describes how to create the required *landing zone manifest file* and use it with the `CreateLandingZone` API operation. 

## Creating the manifest file
<a name="w2aac15c17c17b5"></a>

 The manifest file is a JSON document that specifies your landing zone configuration. With landing zone version 4.0, many components are now optional, allowing for a more flexible deployment. 

### Manifest Structure
<a name="w2aac15c17c17b5b5"></a>

Below is the complete structure of the manifest file with all available configurations:

```
{
    "accessManagement": {
        "enabled": true    // Required - Controls IAM Identity Center integration
    },
    "backup": {
        "enabled": true,   // Required - Controls AWS Backup integration
        "configurations": {
            "backupAdmin": {
                "accountId": "111122223333"    // Backup administrator account
            },
            "centralBackup": {
                "accountId": "111122224444"    // Central backup account
            },
            "kmsKeyArn": "arn:aws:kms:region:account-id:key/key-id"
        }
    },
    "centralizedLogging": {
        "accountId": "111122225555",    // Log archive account
        "enabled": true,                // Required - Controls centralized logging
        "configurations": {
            "accessLoggingBucket": {
                "retentionDays": 365    // Minimum value: 1
            },
            "loggingBucket": {
                "retentionDays": 365    // Minimum value: 1
            },
            "kmsKeyArn": "arn:aws:kms:region:account-id:key/key-id"
        }
    },
    "config": {
        "accountId": "111122226666",    // Config aggregator account
        "enabled": true,                // Required - Controls AWS Config integration
        "configurations": {
            "accessLoggingBucket": {
                "retentionDays": 365    // Minimum value: 1
            },
            "loggingBucket": {
                "retentionDays": 365    // Minimum value: 1
            },
            "kmsKeyArn": "arn:aws:kms:region:account-id:key/key-id"
        }
    },
    "governedRegions": [               // Optional - List of regions to govern
        "us-east-1",
        "us-west-2"
    ],
    "securityRoles": {
        "enabled": true,               // Required - Controls security roles creation
        "accountId": ""111122226666"    // Security/Audit account
    }
}
```

### Important Notes
<a name="w2aac15c17c17b5b7"></a>
+ All `enabled` flags are required in the manifest.
+ If you disable AWS Config integration (`"config.enabled": false`), you must also disable the following integrations:
  + Security Roles (`"securityRoles.enabled": false`)
  + Access Management (`"accessManagement.enabled": false`)
  + Backup (`"backup.enabled": false`)
+ Account IDs must be valid 12-digit AWS account IDs.
+ KMS key ARNs must be valid AWS KMS key ARNs.
+ Retention days must be at least 1.

## Using the CreateLandingZone API
<a name="w2aac15c17c17b7"></a>

To create your landing zone using the API:

```
                    aws controltower create-landing-zone --landing-zone-version 4.0 --manifest file://manifest.json
```

The API will return a landing zone operation ID that you can use to track the progress of your landing zone creation. Sample response:

```
{
    "arn": "arn:aws:controltower:us-west-2:123456789012:landingzone/1A2B3C4D5E6F7G8H",
    "operationIdentifier": "55XXXXXX-e2XX-41XX-a7XX-446XXXXXXXXX"
}
```

You can monitor the operation status using `GetLandingZoneOperation` API which returns a **status** of `SUCCEEDED`, `FAILED`, or `IN_PROGRESS`:

```
                    aws controltower get-landing-zone-operation --operation-identifier "55XXXXXX-eXXX-4XXX-aXXX-44XXXXXXXXXX"
```

## What's Changed in landing zone version 4.0
<a name="w2aac15c17c17b9"></a>

Important changes to the manifest structure and requirements:
+ Organization Structure
  + `organizationStructure` definition has been removed from the manifest
  + Customers can now define their own organizational structure
  + Only requirement: Service integration accounts must be in the same OU directly under root
+ Enabled Flags
  + All service integration configurations have an `enabled` flag which is now a required field.
  + Customers need to always provide a boolean value. No default values are provided.
  + Customers need to explicitly enable/disable each service integration configuration in the manifest:
    + `accessManagement`
    + `backup`
    + `centralizedLogging`
    + `config`
    + `securityRoles`
+ Security Roles
  + Security Roles integration is now optional
  + New `enabled` flag introduced to manage `securityRoles` deployment
  + When disabled, related security features will not be implemented
+ AWS Config Integration
  + New AWS Config service integration section added to manifest as `config` with the following fields:
    + `enabled`: Required boolean flag to manage AWS Config integration deployment
    + `accountId`: AWS account ID for AWS Config aggregator
    + configurations:
      + `accessLoggingBucket.retentionDays`: Retention period for access logs
      + `loggingBucket.retentionDays`: Retention period for AWS Config logs
      + `kmsKeyArn`: KMS key for encryption

# Identify your landing zone
<a name="lz-api-list"></a>

Calling `ListLandingZones` can help you determine if your account is already set up with AWS Control Tower. This API returns one landing zone identifier (ARN) across any **commercial** region, regardless of the landing zone's home region. Landing zone ARNs are regionally unique. 

```
aws controltower list-landing-zones --region us-east-1
```

For [opt-in regions](https://docs.aws.amazon.com/controltower/latest/userguide/opt-in-region-considerations.html), the `ListLandingZones` API only returns the landing zone identifier *if you call the API in the same region as the API's home region*. For example, if your landing zone is set up in af-south-1 and you call `ListLandingZones` *in af-south-1*, the API returns the landing zone identifier. If your landing zone is set up in af-south-1 and you call `ListLandingZones` *in ap-east-1*, the API **does not** return the landing zone identifier. 

**Output**: 

```
{
   "landingZones" [
        "arn": "arn:aws:controltower:us-west-2:123456789123:landingzone/1A2B3C4D5E6F7G8H"
   ]
}
```

# Update your landing zone
<a name="lz-api-update"></a>

When a new landing zone version is available, or to make other updates to your landing zone configuration, you can call the `UpdateLandingZone` API and reference an updated landing zone manifest file. This API returns an `OperationIdentifier`, which you can then use when calling the `GetLandingZoneOperation` API to check the update operation's status. 

**To update the landing zone**

1. Call the AWS Control Tower `UpdateLandingZone` API and refer to the updated **landing zone version** or your **updated landing zone manifest file**. 

   ```
   aws controltower update-landing-zone --landing-zone-version 3.3 --landing-zone-identifier "arn:aws:controltower:us-west-2:123456789123:landingzone/1A2B3C4D5E6F7G8H" --manifest file://LandingZoneManifest.json
   ```

**Example LandingZoneManifest.json** file, with Regions and centralized logging: 

```
{
   "governedRegions": ["us-west-2","us-west-1"],
   "organizationStructure": {
       "security": {
           "name": "Security"
       },
       "sandbox": {
           "name": "Sandbox"
       }
   },
   "centralizedLogging": {
        "accountId": "LOG ARCHIVE ACCOUNT ID",
        "configurations": {
            "loggingBucket": {
                "retentionDays":2555
            },
            "accessLoggingBucket": {
                "retentionDays": 2555
            },
            "kmsKeyArn": "arn:aws:kms:us-west-1:123456789123:key/e84XXXXX-6bXX-49XX-9eXX-ecfXXXXXXXXX"
        },
        "enabled": true
   },
   "securityRoles": {
        "accountId": "SECURITY ACCOUNT ID"
   },
   "accessManagement": {
        "enabled": true
   }
}
```

**Output**: 

```
{
   "operationIdentifier": "55XXXXXX-e2XX-41XX-a7XX-446XXXXXXXXX"
}
```

**Optionally Re-register OU to update accounts**  
For registered AWS Control Tower OUs with fewer than 1000 accounts, you can use the AWS Control Tower console access the **OU page** in the dashboard and select **Re-register OU** to update the accounts in that OU.

# Reset the landing zone to resolve drift
<a name="lz-api-reset"></a>

When you create your landing zone, the landing zone and all the organizational units (OUs), accounts, and resources are compliant with the governance rules enforced by your chosen controls. As you and your organization members use the landing zone, changes in this compliance status may occur. These changes are called *drift*. 

To identify if your landing zone is in drift, you can call the `GetLandingZone` API. This API returns the landing zone's **drift status** of `DRIFTED` or `IN_SYNC`. 

To resolve drift within your landing zone you can use the `ResetLandingZone` API to reset the landing zone back to its original configuration. For example, AWS Control Tower enables IAM Identity Center by default to help you manage your AWS accounts-- but if you configure your original landing zone parameters with IAM Identity Center disabled, calling `ResetLandingZone` maintains that disabled IAM Identity Center configuration. 

You can only use the `ResetLandingZone` API if you are using the latest available landing zone version. You can call the `GetLandingZone` API and compare your landing zone version with the **latest available version**. If necessary, you can [Update your landing zone](lz-api-update.md) so your landing zone uses the latest available version. In these examples, we are using version 3.3 as the latest version.

1. Call the `GetLandingZone` API. If the API returns a **drift status** of `DRIFTED`, your landing zone is in drift. 

1. Call the `ResetLandingZone` API to reset your landing zone to its original configuration. 

   ```
   aws controltower reset-landing-zone --landing-zone-identifier "arn:aws:controltower:us-west-2:123456789123:landingzone/1A2B3C4D5E6F7G8H" 
   ```

**Output**: 

```
{
   "operationIdentifier": "55XXXXXX-e2XX-41XX-a7XX-446XXXXXXXXX"
}
```

**Note**  
Resetting the landing zone does not update the landing zone version. Review [Update your landing zone](lz-api-update.md) for details about updating the landing zone version. 

# View the details of your landing zone manifest file
<a name="lz-manifest-file"></a>

The AWS Control Tower landing zone manifest file is a text file that describes your AWS Control Tower resources. The following sections show detailed definitions of entries in the landing zone manifest file.

To see a full landing zone schema example, see [Landing zone schemas](https://docs.aws.amazon.com//controltower/latest/userguide/landing-zone-schemas.html).

**governedRegions** – Regions to place under governance 
+  **Type:** List of strings
+ **Required:** No
+ **Example:**

  ```
  "governedRegions": ["us-west-2","us-west-1"]
  ```

**organizationStructure** – Select the names of security and sandbox OUs to be created in your organization
+  **Type:** Object
+ **Required:** Yes
+ **Properties:**
+ **Example:**
  + `security` - an object with one required property, `name`, which takes a `String`
  + `sandbox` - an object with one required property, `name`, which takes a `String`

  ```
  "organizationStructure": {
         "security": {
             "name": "CORE"
         },
         "sandbox": {
             "name": "Sandbox"
         }
     }
  ```

**centralizedLogging** – Configuration for AWS CloudTrail
+  **Type:** Object
+ **Required:** Yes
+ **Properties:**
  + *accountId* - a `String` the represents the AWS account into which the logging resource should be deployed
  + *configurations* - an `Object` with three properties
    + `loggingBucket` - an object with one property, `retentionDays`, which takes a `Number`
    + `accessLoggingBucket` - an object with one property, `retentionDays`, which takes a `Number`
    + `kmsKeyArn` - an optional `String`
  + *enabled* - an optional `Boolean` 
+ **Example:**

  ```
  "centralizedLogging": {
          "accountId": "222222222222",
          "configurations": {
              "loggingBucket": {
                  "retentionDays": 60
              },
              "accessLoggingBucket": {
                  "retentionDays": 60
              },
              "kmsKeyArn": "arn:aws:kms:us-west-1:123456789123:key/e84XXXXX-6bXX-49XX-9eXX-ecfXXXXXXXXX"
          },
          "enabled": true
     }
  ```

**securityRoles** – Choose where to deploy the logging resource
+  **Type:** Object
+ **Required:** Yes
+ **Properties:** *accountId* - a `String` that represents the AWS account into which the logging resource should be deployed
+ **Example:**

  ```
  "securityRoles": {
          "accountId": "333333333333"
     }
  ```

**accessManagement** – Choose whthether to enable access management
+  **Type:** Object
+ **Required:** No
+ **Properties:** *enabled* - a Boolean
+ **Example:**

  ```
  "accessManagement": {
          "enabled": true
     }
  ```

**backup** – Configuration for AWS Backup with AWS Control Tower
+  **Type:** Object
+ **Required:** No
+ **Properties:**
  + *configurations* - an `Object` with three properties
    + `centralBackup` - an object with one property, `accountId`, which takes a `String`
    + `backupAdmin` - an object with one property, `accountId`, which takes a `String`
    + `kmsKeyArn` - an optional `String`
  + *enabled* - a `Boolean` 
+ **Example:**

  ```
  "backup": {
      "configurations": {
          "centralBackup": {
              "accountId": "CENTRAL BACKUP ACCOUNT ID"
          },
          "backupAdmin": {
              "accountId": "BACKUP MANAGER ACCOUNT ID"
          },
          "kmsKeyArn": "arn:aws:kms:us-west-1:123456789123:key/e84XXXXX-6bXX-49XX-9eXX-ecfXXXXXXXXX"
      },
      "enabled": true
  }
  ```

# View the status of your landing zone operations
<a name="lz-api-examples-short"></a>

The `ListLandingZoneOperations` API allows you to view the status of AWS Control Tower operations that perform actions on your landing zone.

For more information about this API operation, see [ListLandingZoneOperations](https://docs.aws.amazon.com//controltower/latest/APIReference/API_ListLandingZoneOperations.html).

## ListLandingZoneOperations
<a name="list-lz-operations-api-examples"></a>

**Example input and output for `ListLandingZoneOperations`**.

This example shows how to call the API with no parameters.

```
aws controltower --region us-east-1 list-landing-zone-operations

{
    "landingZoneOperations": [
        {
            "operationIdentifier": "873fe98d-1ecc-4154-b593-86e4a95ebfXX",
            "operationType": "CREATE",
            "status": "FAILED"
        },
        {
            "operationIdentifier": "0016d43d-a307-4ad8-a2a2-b427b8eb1cXX",
            "operationType": "DELETE",
            "status": "SUCCEEDED"
        },
        {
            "operationIdentifier": "002b8b5a-6bb7-4c40-89cd-5822a73d13XX",
            "operationType": "CREATE",
            "status": "SUCCEEDED"
        },
        {
            "operationIdentifier": "008886a0-f7a2-4df3-90e8-6e9f936507XX",
            "operationType": "CREATE",
            "status": "FAILED"
        }
    ]
}
```

This example shows how to call the API and specify the maximum number of results.

```
aws controltower --region us-east-1 list-landing-zone-operations --max-results 1

{
    "landingZoneOperations": [
        {
            "operationIdentifier": "873fe98d-1ecc-4154-b593-86e4a95ebfXX",
            "operationType": "CREATE",
            "status": "FAILED"
        }
    ],
    "nextToken": "AAMAATFMzwP0QysYY8npWgstfcHGQBj-XCC18ISyd9mkQmzLR7ZFMket4F0aWv8tUTtnsTWOnfblUp_Q9U-nX9_6lEsLHs0RlhceDKskHr0_3fm8KdPTa6ofxMt5SPw8WF7-Jsvw2rJVvhj4DHDipo-y1HVK_eZ__Z3-OzInm403cIHxhbjGPgqCX6FeKr8lwgTDKOejkLYZ9w7J5aqPAKLfVP8KKNda5g0VfMj1wdl4J2nwnHI-UuCTIZ5nUEgXgUHaFq6Ma1pLDfGefZQJn5HmDhhgd5yvqzSRH1BtrHpdV_N1EVP8u3JJr3eWQHe9jNB02lihD4Mdcbm3SJg1tWWw2bxp0cgClepI-1Dxt3FAZ5XMVjDxHQHxdKkrazHunMgBFvwfzauC3Ah0WqJg9dkEP22l5HI9qZ7LtDbYZEb5hCskVmjxFsbbwia_OrL2X8ZDeHZStJkxbC3CPIjFMQuldBlzF6L19GSpHE7XIMlTBzzwWtg92sGlpz0An1Smh12jZDe__u2rx8NSkAT97B0bKtmI2TKjutOx7NYUxOhc5qio8dAJbcMgDkf1m5BjK9R7GKdrVv5EDY5Q6uE8gxM2wGnUr_NkpGqR1aEjLIRfZYKN9so_x4vZZPhwtp1NIv256mIGvMYzNivLZ4FE9RPJFh7rSNwFvWnRSVwFLDkOoqXZV9OUYsXdn3W3FMqBzbG6g2KvMXKrKdbrnJHxGgyNYSbS3ogkQYGeuz-VXRwTUIBInrit4HslNtPE8-IC1gxCjGoYPGtuWBPumK-pUPE="
}
```

This example shows how to call the API and obtain a paginated result with `nextToken`.

```
aws controltower --region us-east-1 list-landing-zone-operations --next-token AAMAATFMzwP0QysYY8npWgstfcHGQBj-XCC18ISyd9mkQmzLR7ZFMket4F0aWv8tUTtnsTWOnfblUp_Q9U-nX9_6lEsLHs0RlhceDKskHr0_3fm8KdPTa6ofxMt5SPw8WF7-Jsvw2rJVvhj4DHDipo-y1HVK_eZ__Z3-OzInm403cIHxhbjGPgqCX6FeKr8lwgTDKOejkLYZ9w7J5aqPAKLfVP8KKNda5g0VfMj1wdl4J2nwnHI-UuCTIZ5nUEgXgUHaFq6Ma1pLDfGefZQJn5HmDhhgd5yvqzSRH1BtrHpdV_N1EVP8u3JJr3eWQHe9jNB02lihD4Mdcbm3SJg1tWWw2bxp0cgClepI-1Dxt3FAZ5XMVjDxHQHxdKkrazHunMgBFvwfzauC3Ah0WqJg9dkEP22l5HI9qZ7LtDbYZEb5hCskVmjxFsbbwia_OrL2X8ZDeHZStJkxbC3CPIjFMQuldBlzF6L19GSpHE7XIMlTBzzwWtg92sGlpz0An1Smh12jZDe__u2rx8NSkAT97B0bKtmI2TKjutOx7NYUxOhc5qio8dAJbcMgDkf1m5BjK9R7GKdrVv5EDY5Q6uE8gxM2wGnUr_NkpGqR1aEjLIRfZYKN9so_x4vZZPhwtp1NIv256mIGvMYzNivLZ4FE9RPJFh7rSNwFvWnRSVwFLDkOoqXZV9OUYsXdn3W3FMqBzbG6g2KvMXKrKdbrnJHxGgyNYSbS3ogkQYGeuz-VXRwTUIBInrit4HslNtPE8-IC1gxCjGoYPGtuWBPumK-pUPE=

{
    "landingZoneOperations": [
        {
            "operationIdentifier": "0016d43d-a307-4ad8-a2a2-b427b8eb1cXX",
            "operationType": "DELETE",
            "status": "SUCCEEDED"
        },
        {
            "operationIdentifier": "002b8b5a-6bb7-4c40-89cd-5822a73d13XX",
            "operationType": "CREATE",
            "status": "SUCCEEDED"
        },
        {
            "operationIdentifier": "008886a0-f7a2-4df3-90e8-6e9f936507XX",
            "operationType": "CREATE",
            "status": "FAILED"
        }
    ]
}
```

This example shows how to call the API with a filter.

```
aws controltower --region us-east-1 list-landing-zone-operations --filter '{"types":["CREATE"],"statuses":["FAILED"]}'

{
    "landingZoneOperations": [
        {
            "operationIdentifier": "873fe98d-1ecc-4154-b593-86e4a95ebfXX",
            "operationType": "CREATE",
            "status": "FAILED"
        },
        {
            "operationIdentifier": "008886a0-f7a2-4df3-90e8-6e9f936507XX",
            "operationType": "CREATE",
            "status": "FAILED"
        }
    ]
}
```

# Examples: Set up an AWS Control Tower landing zone with APIs only
<a name="walkthrough-api-setup"></a>

This walkthrough of examples is a companion document. For explanations, caveats, and more information, see [Getting started with AWS Control Tower using APIs](https://docs.aws.amazon.com//controltower/latest/userguide/getting-started-apis.html).

**Prerequisites**

Before creating an AWS Control Tower landing zone, you must create an organization, two shared accounts, and some IAM roles. This walkthrough tutorial includes these steps, with example CLI commands and output.

**Step 1. Create the organization and two required accounts.**

```
aws organizations create-organization --feature-set ALL
aws organizations create-account --email example+log@example.com --account-name "Log archive account"
aws organizations create-account --email example+aud@example.com --account-name "Audit account"
```

**Step 2. Create the required IAM roles.**

`AWSControlTowerAdmin`

```
cat <<EOF >controltower_trust.json
{
  "Version": "2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "controltower.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF
aws iam create-role --role-name AWSControlTowerAdmin --path /service-role/ --assume-role-policy-document file://controltower_trust.json
cat <<EOF >ct_admin_role_policy.json
{
    "Version": "2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ec2:DescribeAvailabilityZones",
            "Resource": "*"
        }
    ]
}
EOF
aws iam put-role-policy --role-name AWSControlTowerAdmin --policy-name AWSControlTowerAdminPolicy --policy-document file://ct_admin_role_policy.json
aws iam attach-role-policy --role-name AWSControlTowerAdmin --policy-arn arn:aws:iam::aws:policy/service-role/AWSControlTowerServiceRolePolicy
```

`AWSControlTowerCloudTrailRole`

```
cat <<EOF >cloudtrail_trust.json
{
    "Version": "2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudtrail.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
EOF
aws iam create-role --role-name AWSControlTowerCloudTrailRole --path /service-role/ --assume-role-policy-document file://cloudtrail_trust.json
cat <<EOF >cloudtrail_role_policy.json
{
    "Version": "2012-10-17",		 	 	 
    "Statement": [
        {
            "Action": "logs:CreateLogStream",
            "Resource": "arn:aws:logs:*:*:log-group:aws-controltower/CloudTrailLogs:*",
            "Effect": "Allow"
        },
        {
            "Action": "logs:PutLogEvents",
            "Resource": "arn:aws:logs:*:*:log-group:aws-controltower/CloudTrailLogs:*",
            "Effect": "Allow"
        }
    ]
}
EOF
aws iam put-role-policy --role-name AWSControlTowerCloudTrailRole --policy-name AWSControlTowerCloudTrailRolePolicy --policy-document file://cloudtrail_role_policy.json
```

`AWSControlTowerStackSetRole`

```
cat <<EOF >cloudformation_trust.json
{
    "Version": "2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudformation.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
EOF
aws iam create-role --role-name AWSControlTowerStackSetRole --path /service-role/ --assume-role-policy-document file://cloudformation_trust.json
cat <<EOF >stackset_role_policy.json
{
    "Version": "2012-10-17",		 	 	 
    "Statement": [
        {
            "Action": [
                "sts:AssumeRole"
            ],
            "Resource": [
                "arn:aws:iam::*:role/AWSControlTowerExecution"
            ],
            "Effect": "Allow"
        }
    ]
}
EOF
aws iam put-role-policy --role-name AWSControlTowerStackSetRole --policy-name AWSControlTowerStackSetRolePolicy --policy-document file://stackset_role_policy.json
```

`AWSControlTowerConfigAggregatorRoleForOrganizations`

```
cat <<EOF >config_trust.json
{
    "Version": "2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "config.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
EOF
aws iam create-role --role-name AWSControlTowerConfigAggregatorRoleForOrganizations --path /service-role/ --assume-role-policy-document file://config_trust.json
aws iam attach-role-policy --role-name AWSControlTowerConfigAggregatorRoleForOrganizations --policy-arn arn:aws:iam::aws:policy/service-role/AWSConfigRoleForOrganizations
```

**Step 3. Get account IDs and generate the landing zone manifest file.**

The first two commands in the following example store the account IDs for the accounts you created in **Step 1** into variables. These variables then help generate the landing zone manifest file.

```
sec_account_id=$(aws organizations list-accounts | jq -r '.Accounts[] | select(.Name == "Audit account") | .Id')
log_account_id=$(aws organizations list-accounts | jq -r '.Accounts[] | select(.Name == "Log archive account") | .Id')

cat <<EOF >landing_zone_manifest.json
{
   "governedRegions": ["us-west-1", "us-west-2"],
   "organizationStructure": {
       "security": {
           "name": "Security"
       },
       "sandbox": {
           "name": "Sandbox"
       }
   },
   "centralizedLogging": {
        "accountId": "$log_account_id",
        "configurations": {
            "loggingBucket": {
                "retentionDays": 60
            },
            "accessLoggingBucket": {
                "retentionDays": 60
            }
        },
        "enabled": true
   },
   "securityRoles": {
        "accountId": "$sec_account_id"
   },
   "accessManagement": {
        "enabled": true
   }
}
EOF
```

**Step 4. Create the landing zone with the latest version.**

 You must set up the landing zone with the manifest file and the latest version. This example shows version 3.3.

```
aws --region us-west-1 controltower create-landing-zone --manifest file://landing_zone_manifest.json --landing-zone-version 3.3
```

The output will contain an **arn** and an **operationIdentifier**, as shown in the example that follows.

```
{
    "arn": "arn:aws:controltower:us-west-1:0123456789012:landingzone/4B3H0ULNUOL2AXXX",
    "operationIdentifier": "16bb47f7-b7a2-4d90-bc71-7df4ca1201xx"
}
```

**Step 5. (Optional) Track the status of your landing zone creation operation, by setting up a loop.**

To track status, use the **operationIdentifier** from the previous `create-landing-zone` command's output.

```
aws --region us-west-1 controltower get-landing-zone-operation --operation-identifier 16bb47f7-b7a2-4d90-bc71-7df4ca1201xx
```

Sample status output:

```
{
    "operationDetails": {
        "operationType": "CREATE",
        "startTime": "2024-02-28T21:49:31Z",
        "status": "IN_PROGRESS"
    }
}
```

You can use the following example script to help you set up a loop, which reports the operation's status over and over, like a log file. Then you don't need to keep entering the command.

```
while true; do echo "$(date) $(aws --region us-west-1 controltower get-landing-zone-operation --operation-identifier 16bb47f7-b7a2-4d90-bc71-7df4ca1201xx | jq -r .operationDetails.status)"; sleep 15; done
```

**To show detailed information about your landing zone**

*Step 1. Find the ARN of the landing zone*

```
aws --region us-west-1 controltower list-landing-zones
```

Output will include the identifier of the landing zone, as shown in the following example of output.

```
{
    "landingZones": [
        {
            "arn": "arn:aws:controltower:us-west-1:123456789012:landingzone/4B3H0ULNUOL2AXXX"
        }
    ]
}
```

*Step 2. Get the information*

```
aws --region us-west-1 controltower get-landing-zone --landing-zone-identifier arn:aws:controltower:us-west-1:123456789012:landingzone/4B3H0ULNUOL2AXXX
```

Here's an example of the kind of output you may see:

```
{
    "landingZone": {
        "arn": "arn:aws:controltower:us-west-1:123456789012:landingzone/4B3H0ULNUOL2AXXX",
        "driftStatus": {
            "status": "IN_SYNC"
        },
        "latestAvailableVersion": "3.3",
        "manifest": {
            "accessManagement": {
                "enabled": true
            },
            "securityRoles": {
                "accountId": "9750XXXX4444"
            },
            "governedRegions": [
                "us-west-1",
                "us-west-2"
            ],
            "organizationStructure": {
                "sandbox": {
                    "name": "Sandbox"
                },
                "security": {
                    "name": "Security"
                }
            },
            "centralizedLogging": {
                "accountId": "012345678901",
                "configurations": {
                    "loggingBucket": {
                        "retentionDays": 60
                    },
                    "accessLoggingBucket": {
                        "retentionDays": 60
                    }
                },
                "enabled": true
            }
        },
        "status": "ACTIVE",
        "version": "3.3"
    }
}
```

**Step 6. (Optional) Call the `ListLandingZoneOperations` API to view the status of any operations that change your landing zone.**

To track the status of any landing zone operation, you can call the [ListLandingZoneOperations](lz-api-examples-short.md#list-lz-operations-api-examples) API.

# Landing zone schemas
<a name="landing-zone-schemas"></a>

A landing zone is an AWS resource, which is created by means of schemas. Each AWS Control Tower landing zone version has a unique schema.

The schemas for AWS Control Tower landing zones, version 3.1 and newer, are published in this reference section, to assist you in choosing a compatible version.

**Note**  
A known issue regarding *unneccessary access logging* is present in landing zone version 3.0. The issue is addressed in landing zone version 3.1. For more information about the changes, see [AWS Control Tower landing zone version 3.1](2023-all.md#lz-3-1).

## Landing zone 4.0 schema
<a name="lz-4-0-schema"></a>

```
{
    "type": "object",
    "required": [],
    "properties": {
        "accessManagement": {
            "$ref": "#/definitions/AccessManagement"
        },
        "backup": {
            "$ref": "#/definitions/Backup"
        },
        "centralizedLogging": {
            "$ref": "#/definitions/CentralizedLogging"
        },
        "governedRegions": {
            "type": "array",
            "items": {
                "type": "string",
                "maxLength": 24,
                "minLength": 1,
                "pattern": "^[a-z]{2}-[a-z\\-]*-[0-9]{1}$",
                "additionalProperties": false
            },
            "additionalProperties": false
        },
        "securityRoles": {
            "$ref": "#/definitions/SecurityRoles"
        },
        "config": {
            "$ref": "#/definitions/Config"
        }
    },
    "additionalProperties": false,
    "definitions": {
        "AccessManagement": {
            "type": "object",
            "required": [
                "enabled"
            ],
            "properties": {
                "enabled": {
                    "type": "boolean",
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "Backup": {
            "type": "object",
            "required": [
                "enabled"
            ],
            "properties": {
                "configurations": {
                    "$ref": "#/definitions/BackupConfigurations"
                },
                "enabled": {
                    "type": "boolean",
                    "additionalProperties": false
                }
            },
            "additionalProperties": false,
            "if": {
                "properties": {
                    "enabled": {
                        "const": true
                    }
                }
            },
            "then": {
                "required": [
                    "configurations"
                ]
            }
        },
        "BackupAdminConfigurations": {
            "type": "object",
            "required": [
                "accountId"
            ],
            "properties": {
                "accountId": {
                    "type": "string",
                    "maxLength": 12,
                    "minLength": 12,
                    "pattern": "^\\d{12}$",
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "BackupConfigurations": {
            "type": "object",
            "required": [
                "backupAdmin",
                "centralBackup",
                "kmsKeyArn"
            ],
            "properties": {
                "backupAdmin": {
                    "$ref": "#/definitions/BackupAdminConfigurations"
                },
                "centralBackup": {
                    "$ref": "#/definitions/CentralBackupConfigurations"
                },
                "kmsKeyArn": {
                    "type": "string",
                    "maxLength": 2048,
                    "minLength": 1,
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "CentralBackupConfigurations": {
            "type": "object",
            "required": [
                "accountId"
            ],
            "properties": {
                "accountId": {
                    "type": "string",
                    "maxLength": 12,
                    "minLength": 12,
                    "pattern": "^\\d{12}$",
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "CentralizedLogging": {
            "type": "object",
            "required": [
                "enabled"
            ],
            "properties": {
                "accountId": {
                    "type": "string",
                    "maxLength": 12,
                    "minLength": 12,
                    "pattern": "^\\d{12}$",
                    "additionalProperties": false
                },
                "configurations": {
                    "$ref": "#/definitions/LoggingConfigurations"
                },
                "enabled": {
                    "type": "boolean",
                    "additionalProperties": false
                }
            },
            "additionalProperties": false,
            "if": {
                "properties": {
                    "enabled": {
                        "const": true
                    }
                }
            },
            "then": {
                "required": [
                    "accountId"
                ]
            }
        },
        "LoggingConfigurations": {
            "type": "object",
            "properties": {
                "accessLoggingBucket": {
                    "$ref": "#/definitions/S3BucketConfiguration"
                },
                "kmsKeyArn": {
                    "type": "string",
                    "maxLength": 2048,
                    "minLength": 1,
                    "additionalProperties": false
                },
                "loggingBucket": {
                    "$ref": "#/definitions/S3BucketConfiguration"
                }
            },
            "additionalProperties": false
        },
        "S3BucketConfiguration": {
            "type": "object",
            "properties": {
                "retentionDays": {
                    "type": "number",
                    "minimum": 1,
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "SecurityRoles": {
            "type": "object",
            "required": [
                "enabled"
            ],
            "properties": {
                "accountId": {
                    "type": "string",
                    "maxLength": 12,
                    "minLength": 12,
                    "pattern": "^\\d{12}$",
                    "additionalProperties": false
                },
                "enabled": {
                    "type": "boolean",
                    "additionalProperties": false
                }
            },
            "additionalProperties": false,
            "if": {
                "properties": {
                    "enabled": {
                        "const": true
                    }
                }
            },
            "then": {
                "required": [
                    "accountId"
                ]
            }
        },
        "Config": {
            "type": "object",
            "required": [
                "enabled"
            ],
            "properties": {
                "accountId": {
                    "type": "string",
                    "maxLength": 12,
                    "minLength": 12,
                    "pattern": "^\\d{12}$",
                    "additionalProperties": false
                },
                "configurations": {
                    "$ref": "#/definitions/ConfigConfiguration"
                },
                "enabled": {
                    "type": "boolean",
                    "additionalProperties": false
                }
            },
            "additionalProperties": false,
            "if": {
                "properties": {
                    "enabled": {
                        "const": true
                    }
                }
            },
            "then": {
                "required": [
                    "accountId"
                ]
            }
        },
        "ConfigConfiguration": {
            "type": "object",
            "required": [],
            "properties": {
                "loggingBucket": {
                    "$ref": "#/definitions/S3BucketConfiguration"
                },
                "accessLoggingBucket": {
                    "$ref": "#/definitions/S3BucketConfiguration"
                },
                "kmsKeyArn": {
                    "type": "string",
                    "maxLength": 2048,
                    "minLength": 1,
                    "additionalProperties": false
                }
            }
        }
    }
}
```

## Landing zone 3.3 schema
<a name="lz-3-3-schema"></a>

```
{
    "type": "object",
    "required": [
        "centralizedLogging",
        "organizationStructure",
        "securityRoles"
    ],
    "properties": {
        "accessManagement": {
            "$ref": "#/definitions/AccessManagement"
        },
        "backup": {
            "$ref": "#/definitions/Backup"
        },
        "centralizedLogging": {
            "$ref": "#/definitions/CentralizedLogging"
        },
        "governedRegions": {
            "type": "array",
            "items": {
                "type": "string",
                "maxLength": 24,
                "minLength": 1,
                "pattern": "^[a-z]{2}-[a-z\\-]*-[0-9]{1}$",
                "additionalProperties": false
            },
            "additionalProperties": false
        },
        "organizationStructure": {
            "$ref": "#/definitions/OrganizationStructure"
        },
        "securityRoles": {
            "$ref": "#/definitions/SecurityRoles"
        }
    },
    "additionalProperties": false,
    "definitions": {
        "AccessManagement": {
            "type": "object",
            "required": [
                "enabled"
            ],
            "properties": {
                "enabled": {
                    "type": "boolean",
                    "additionalProperties": false,
                    "default": true
                }
            },
            "additionalProperties": false
        },
        "Backup": {
            "type": "object",
            "properties": {
                "configurations": {
                    "$ref": "#/definitions/BackupConfigurations"
                },
                "enabled": {
                    "type": "boolean",
                    "additionalProperties": false,
                    "default": false
                }
            },
            "additionalProperties": false,
            "if": {
                "properties": {
                    "enabled": {
                        "const": true
                    }
                }
            },
            "then": {
                "required": [
                    "configurations"
                ]
            }
        },
        "BackupAdminConfigurations": {
            "type": "object",
            "required": [
                "accountId"
            ],
            "properties": {
                "accountId": {
                    "type": "string",
                    "maxLength": 12,
                    "minLength": 12,
                    "pattern": "^\\d{12}$",
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "BackupConfigurations": {
            "type": "object",
            "required": [
                "backupAdmin",
                "centralBackup",
                "kmsKeyArn"
            ],
            "properties": {
                "backupAdmin": {
                    "$ref": "#/definitions/BackupAdminConfigurations"
                },
                "centralBackup": {
                    "$ref": "#/definitions/CentralBackupConfigurations"
                },
                "kmsKeyArn": {
                    "type": "string",
                    "maxLength": 2048,
                    "minLength": 1,
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "CentralBackupConfigurations": {
            "type": "object",
            "required": [
                "accountId"
            ],
            "properties": {
                "accountId": {
                    "type": "string",
                    "maxLength": 12,
                    "minLength": 12,
                    "pattern": "^\\d{12}$",
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "CentralizedLogging": {
            "type": "object",
            "required": [
                "accountId"
            ],
            "properties": {
                "accountId": {
                    "type": "string",
                    "maxLength": 12,
                    "minLength": 12,
                    "pattern": "^\\d{12}$",
                    "additionalProperties": false
                },
                "configurations": {
                    "$ref": "#/definitions/LoggingConfigurations"
                },
                "enabled": {
                    "type": "boolean",
                    "additionalProperties": false,
                    "default": true
                }
            },
            "additionalProperties": false
        },
        "LoggingConfigurations": {
            "type": "object",
            "properties": {
                "accessLoggingBucket": {
                    "$ref": "#/definitions/S3BucketConfiguration"
                },
                "kmsKeyArn": {
                    "type": "string",
                    "maxLength": 2048,
                    "minLength": 1,
                    "additionalProperties": false
                },
                "loggingBucket": {
                    "$ref": "#/definitions/S3BucketConfiguration"
                }
            },
            "additionalProperties": false
        },
        "OrganizationalUnit": {
            "type": "object",
            "required": [
                "name"
            ],
            "properties": {
                "name": {
                    "type": "string",
                    "maxLength": 120,
                    "minLength": 1,
                    "pattern": "^[\\s\\S]*$",
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "OrganizationStructure": {
            "type": "object",
            "required": [
                "security"
            ],
            "properties": {
                "sandbox": {
                    "$ref": "#/definitions/OrganizationalUnit"
                },
                "security": {
                    "$ref": "#/definitions/OrganizationalUnit"
                }
            },
            "additionalProperties": false
        },
        "S3BucketConfiguration": {
            "type": "object",
            "properties": {
                "retentionDays": {
                    "type": "number",
                    "minimum": 1,
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "SecurityRoles": {
            "type": "object",
            "required": [
                "accountId"
            ],
            "properties": {
                "accountId": {
                    "type": "string",
                    "maxLength": 12,
                    "minLength": 12,
                    "pattern": "^\\d{12}$",
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        }
    }
}
```

## Landing zone 3.2 schema
<a name="lz-3-2-schema"></a>

```
{
    "type": "object",
    "required": [
        "centralizedLogging",
        "organizationStructure",
        "securityRoles"
    ],
    "properties": {
        "accessManagement": {
            "$ref": "#/definitions/AccessManagement"
        },
        "backup": {
            "$ref": "#/definitions/Backup"
        },
        "centralizedLogging": {
            "$ref": "#/definitions/CentralizedLogging"
        },
        "governedRegions": {
            "type": "array",
            "items": {
                "type": "string",
                "maxLength": 24,
                "minLength": 1,
                "pattern": "^[a-z]{2}-[a-z\\-]*-[0-9]{1}$",
                "additionalProperties": false
            },
            "additionalProperties": false
        },
        "organizationStructure": {
            "$ref": "#/definitions/OrganizationStructure"
        },
        "securityRoles": {
            "$ref": "#/definitions/SecurityRoles"
        }
    },
    "additionalProperties": false,
    "definitions": {
        "AccessManagement": {
            "type": "object",
            "required": [
                "enabled"
            ],
            "properties": {
                "enabled": {
                    "type": "boolean",
                    "additionalProperties": false,
                    "default": true
                }
            },
            "additionalProperties": false
        },
        "Backup": {
            "type": "object",
            "properties": {
                "configurations": {
                    "$ref": "#/definitions/BackupConfigurations"
                },
                "enabled": {
                    "type": "boolean",
                    "additionalProperties": false,
                    "default": false
                }
            },
            "additionalProperties": false,
            "if": {
                "properties": {
                    "enabled": {
                        "const": true
                    }
                }
            },
            "then": {
                "required": [
                    "configurations"
                ]
            }
        },
        "BackupAdminConfigurations": {
            "type": "object",
            "required": [
                "accountId"
            ],
            "properties": {
                "accountId": {
                    "type": "string",
                    "maxLength": 12,
                    "minLength": 12,
                    "pattern": "^\\d{12}$",
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "BackupConfigurations": {
            "type": "object",
            "required": [
                "backupAdmin",
                "centralBackup",
                "kmsKeyArn"
            ],
            "properties": {
                "backupAdmin": {
                    "$ref": "#/definitions/BackupAdminConfigurations"
                },
                "centralBackup": {
                    "$ref": "#/definitions/CentralBackupConfigurations"
                },
                "kmsKeyArn": {
                    "type": "string",
                    "maxLength": 2048,
                    "minLength": 1,
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "CentralBackupConfigurations": {
            "type": "object",
            "required": [
                "accountId"
            ],
            "properties": {
                "accountId": {
                    "type": "string",
                    "maxLength": 12,
                    "minLength": 12,
                    "pattern": "^\\d{12}$",
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "CentralizedLogging": {
            "type": "object",
            "required": [
                "accountId"
            ],
            "properties": {
                "accountId": {
                    "type": "string",
                    "maxLength": 12,
                    "minLength": 12,
                    "pattern": "^\\d{12}$",
                    "additionalProperties": false
                },
                "configurations": {
                    "$ref": "#/definitions/LoggingConfigurations"
                },
                "enabled": {
                    "type": "boolean",
                    "additionalProperties": false,
                    "default": true
                }
            },
            "additionalProperties": false
        },
        "LoggingConfigurations": {
            "type": "object",
            "properties": {
                "accessLoggingBucket": {
                    "$ref": "#/definitions/S3BucketConfiguration"
                },
                "kmsKeyArn": {
                    "type": "string",
                    "maxLength": 2048,
                    "minLength": 1,
                    "additionalProperties": false
                },
                "loggingBucket": {
                    "$ref": "#/definitions/S3BucketConfiguration"
                }
            },
            "additionalProperties": false
        },
        "OrganizationalUnit": {
            "type": "object",
            "required": [
                "name"
            ],
            "properties": {
                "name": {
                    "type": "string",
                    "maxLength": 120,
                    "minLength": 1,
                    "pattern": "^[\\s\\S]*$",
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "OrganizationStructure": {
            "type": "object",
            "required": [
                "security"
            ],
            "properties": {
                "sandbox": {
                    "$ref": "#/definitions/OrganizationalUnit"
                },
                "security": {
                    "$ref": "#/definitions/OrganizationalUnit"
                }
            },
            "additionalProperties": false
        },
        "S3BucketConfiguration": {
            "type": "object",
            "properties": {
                "retentionDays": {
                    "type": "number",
                    "minimum": 1,
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "SecurityRoles": {
            "type": "object",
            "required": [
                "accountId"
            ],
            "properties": {
                "accountId": {
                    "type": "string",
                    "maxLength": 12,
                    "minLength": 12,
                    "pattern": "^\\d{12}$",
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        }
    }
}
```

## Landing zone 3.1 schema
<a name="lz-3-1-schema"></a>

```
{
    "type": "object",
    "required": [
        "centralizedLogging",
        "organizationStructure",
        "securityRoles"
    ],
    "properties": {
        "accessManagement": {
            "$ref": "#/definitions/AccessManagement"
        },
        "backup": {
            "$ref": "#/definitions/Backup"
        },
        "centralizedLogging": {
            "$ref": "#/definitions/CentralizedLogging"
        },
        "governedRegions": {
            "type": "array",
            "items": {
                "type": "string",
                "maxLength": 24,
                "minLength": 1,
                "pattern": "^[a-z]{2}-[a-z\\-]*-[0-9]{1}$",
                "additionalProperties": false
            },
            "additionalProperties": false
        },
        "organizationStructure": {
            "$ref": "#/definitions/OrganizationStructure"
        },
        "securityRoles": {
            "$ref": "#/definitions/SecurityRoles"
        }
    },
    "additionalProperties": false,
    "definitions": {
        "AccessManagement": {
            "type": "object",
            "required": [
                "enabled"
            ],
            "properties": {
                "enabled": {
                    "type": "boolean",
                    "additionalProperties": false,
                    "default": true
                }
            },
            "additionalProperties": false
        },
        "Backup": {
            "type": "object",
            "properties": {
                "configurations": {
                    "$ref": "#/definitions/BackupConfigurations"
                },
                "enabled": {
                    "type": "boolean",
                    "additionalProperties": false,
                    "default": false
                }
            },
            "additionalProperties": false,
            "if": {
                "properties": {
                    "enabled": {
                        "const": true
                    }
                }
            },
            "then": {
                "required": [
                    "configurations"
                ]
            }
        },
        "BackupAdminConfigurations": {
            "type": "object",
            "required": [
                "accountId"
            ],
            "properties": {
                "accountId": {
                    "type": "string",
                    "maxLength": 12,
                    "minLength": 12,
                    "pattern": "^\\d{12}$",
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "BackupConfigurations": {
            "type": "object",
            "required": [
                "backupAdmin",
                "centralBackup",
                "kmsKeyArn"
            ],
            "properties": {
                "backupAdmin": {
                    "$ref": "#/definitions/BackupAdminConfigurations"
                },
                "centralBackup": {
                    "$ref": "#/definitions/CentralBackupConfigurations"
                },
                "kmsKeyArn": {
                    "type": "string",
                    "maxLength": 2048,
                    "minLength": 1,
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "CentralBackupConfigurations": {
            "type": "object",
            "required": [
                "accountId"
            ],
            "properties": {
                "accountId": {
                    "type": "string",
                    "maxLength": 12,
                    "minLength": 12,
                    "pattern": "^\\d{12}$",
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "CentralizedLogging": {
            "type": "object",
            "required": [
                "accountId"
            ],
            "properties": {
                "accountId": {
                    "type": "string",
                    "maxLength": 12,
                    "minLength": 12,
                    "pattern": "^\\d{12}$",
                    "additionalProperties": false
                },
                "configurations": {
                    "$ref": "#/definitions/LoggingConfigurations"
                },
                "enabled": {
                    "type": "boolean",
                    "additionalProperties": false,
                    "default": true
                }
            },
            "additionalProperties": false
        },
        "LoggingConfigurations": {
            "type": "object",
            "properties": {
                "accessLoggingBucket": {
                    "$ref": "#/definitions/S3BucketConfiguration"
                },
                "kmsKeyArn": {
                    "type": "string",
                    "maxLength": 2048,
                    "minLength": 1,
                    "additionalProperties": false
                },
                "loggingBucket": {
                    "$ref": "#/definitions/S3BucketConfiguration"
                }
            },
            "additionalProperties": false
        },
        "OrganizationalUnit": {
            "type": "object",
            "required": [
                "name"
            ],
            "properties": {
                "name": {
                    "type": "string",
                    "maxLength": 120,
                    "minLength": 1,
                    "pattern": "^[\\s\\S]*$",
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "OrganizationStructure": {
            "type": "object",
            "required": [
                "security"
            ],
            "properties": {
                "sandbox": {
                    "$ref": "#/definitions/OrganizationalUnit"
                },
                "security": {
                    "$ref": "#/definitions/OrganizationalUnit"
                }
            },
            "additionalProperties": false
        },
        "S3BucketConfiguration": {
            "type": "object",
            "properties": {
                "retentionDays": {
                    "type": "number",
                    "minimum": 1,
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        },
        "SecurityRoles": {
            "type": "object",
            "required": [
                "accountId"
            ],
            "properties": {
                "accountId": {
                    "type": "string",
                    "maxLength": 12,
                    "minLength": 12,
                    "pattern": "^\\d{12}$",
                    "additionalProperties": false
                }
            },
            "additionalProperties": false
        }
    }
}
```

# Launch a landing zone using CloudFormation
<a name="lz-apis-cfn"></a>

You can configure and launch a landing zone with CloudFormation either through the CloudFormation console, or through the AWS CLI. This section provides instructions and examples to launch a landing zone using APIs through CloudFormation. 

**Topics**
+ [

# Prerequisites for launching a landing zone using CloudFormation
](lz-apis-cfn-setup.md)
+ [

# Create a new landing zone using CloudFormation
](lz-apis-cfn-launch.md)
+ [

# Manage an existing landing zone using CloudFormation
](lz-apis-cfn-launch-existing.md)

# Prerequisites for launching a landing zone using CloudFormation
<a name="lz-apis-cfn-setup"></a>

1. From the AWS CLI, use the AWS Organizations `CreateOrganization` API to create an organization and enable all features. 

   For more detailed instructions, review [Step 1: Configure your landing zone](lz-api-prereques.md). 

1. From the CloudFormation console or using the AWS CLI, deploy a CloudFormation template that creates the following resources in the management account: 
   + Log Archive account (sometimes called the "Logging" account) 
   + Audit account (sometimes called the "Security" account) 
   + The **AWSControlTowerAdmin**, **AWSControlTowerCloudTrailRole**, **AWSControlTowerConfigAggregatorRoleForOrganizations**, and **AWSControlTowerStackSetRole** service roles. 

     For information about how AWS Control Tower uses these roles to perform landing zone API calls, see [Step 1: Configure your landing zone](lz-api-prereques.md). 

   ```
   Parameters:
     LoggingAccountEmail:
       Type: String
       Description: The email Id for centralized logging account
     LoggingAccountName:
       Type: String
       Description: Name for centralized logging account
     SecurityAccountEmail:
       Type: String
       Description: The email Id for security roles account
     SecurityAccountName:
       Type: String
       Description: Name for security roles account
   Resources:
     MyOrganization:
       Type: 'AWS::Organizations::Organization'
       Properties:
         FeatureSet: ALL
     LoggingAccount:
       Type: 'AWS::Organizations::Account'
       Properties:
         AccountName: !Ref LoggingAccountName
         Email: !Ref LoggingAccountEmail
     SecurityAccount:
       Type: 'AWS::Organizations::Account'
       Properties:
         AccountName: !Ref SecurityAccountName
         Email: !Ref SecurityAccountEmail
     AWSControlTowerAdmin:
       Type: 'AWS::IAM::Role'
       Properties:
         RoleName: AWSControlTowerAdmin
         AssumeRolePolicyDocument:
           Version: 2012-10-17		 	 	 
           Statement:
             - Effect: Allow
               Principal:
                 Service: controltower.amazonaws.com
               Action: 'sts:AssumeRole'
         Path: '/service-role/'
         ManagedPolicyArns:
           - !Sub >-
             arn:${AWS::Partition}:iam::aws:policy/service-role/AWSControlTowerServiceRolePolicy
     AWSControlTowerAdminPolicy:
       Type: 'AWS::IAM::Policy'
       Properties:
         PolicyName: AWSControlTowerAdminPolicy
         PolicyDocument:
           Version: 2012-10-17		 	 	 
           Statement:
             - Effect: Allow
               Action: 'ec2:DescribeAvailabilityZones'
               Resource: '*'
         Roles:
           - !Ref AWSControlTowerAdmin
     AWSControlTowerCloudTrailRole:
       Type: 'AWS::IAM::Role'
       Properties:
         RoleName: AWSControlTowerCloudTrailRole
         AssumeRolePolicyDocument:
           Version: 2012-10-17		 	 	 
           Statement:
             - Effect: Allow
               Principal:
                 Service: cloudtrail.amazonaws.com
               Action: 'sts:AssumeRole'
         Path: '/service-role/'
     AWSControlTowerCloudTrailRolePolicy:
       Type: 'AWS::IAM::Policy'
       Properties:
         PolicyName: AWSControlTowerCloudTrailRolePolicy
         PolicyDocument:
           Version: 2012-10-17		 	 	 
           Statement:
             - Action:
                 - 'logs:CreateLogStream'
                 - 'logs:PutLogEvents'
               Resource: !Sub >-
                 arn:${AWS::Partition}:logs:*:*:log-group:aws-controltower/CloudTrailLogs:*
               Effect: Allow
         Roles:
           - !Ref AWSControlTowerCloudTrailRole
     AWSControlTowerConfigAggregatorRoleForOrganizations:
       Type: 'AWS::IAM::Role'
       Properties:
         RoleName: AWSControlTowerConfigAggregatorRoleForOrganizations
         AssumeRolePolicyDocument:
           Version: 2012-10-17		 	 	 
           Statement:
             - Effect: Allow
               Principal:
                 Service: config.amazonaws.com
               Action: 'sts:AssumeRole'
         Path: '/service-role/'
         ManagedPolicyArns:
           - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSConfigRoleForOrganizations
     AWSControlTowerStackSetRole:
       Type: 'AWS::IAM::Role'
       Properties:
         RoleName: AWSControlTowerStackSetRole
         AssumeRolePolicyDocument:
           Version: 2012-10-17		 	 	 
           Statement:
             - Effect: Allow
               Principal:
                 Service: cloudformation.amazonaws.com
               Action: 'sts:AssumeRole'
         Path: '/service-role/'
     AWSControlTowerStackSetRolePolicy:
       Type: 'AWS::IAM::Policy'
       Properties:
         PolicyName: AWSControlTowerStackSetRolePolicy
         PolicyDocument:
           Version: 2012-10-17		 	 	 
           Statement:
             - Action: 'sts:AssumeRole'
               Resource: !Sub 'arn:${AWS::Partition}:iam::*:role/AWSControlTowerExecution'
               Effect: Allow
         Roles:
           - !Ref AWSControlTowerStackSetRole
   
   Outputs:
     LogAccountId:
       Value:
         Fn::GetAtt: LoggingAccount.AccountId
       Export:
         Name: LogAccountId
     SecurityAccountId:
       Value:
         Fn::GetAtt: SecurityAccount.AccountId
       Export:
         Name: SecurityAccountId
   ```

# Create a new landing zone using CloudFormation
<a name="lz-apis-cfn-launch"></a>

From the CloudFormation console or using the AWS CLI, deploy the following CloudFormation template to create a landing zone. 

```
Parameters:
  Version:
    Type: String
    Description: The version number of Landing Zone
  GovernedRegions:
    Type: Array
    Description: List of governed regions
  SecurityOuName:
    Type: String
    Description: The security Organizational Unit name
  SandboxOuName:
    Type: String
    Description: The sandbox Organizational Unit name
  CentralizedLoggingAccountId:
    Type: String
    Description: The AWS account ID for centralized logging
  SecurityAccountId:
    Type: String
    Description: The AWS account ID for security roles
  LoggingBucketRetentionPeriod:
    Type: Number
    Description: Retention period for centralized logging bucket
  AccessLoggingBucketRetentionPeriod:
    Type: Number
    Description: Retention period for access logging bucket
  KMSKey:
    Type: String
    Description: KMS key ARN used by CloudTrail and Config service to encrypt data in logging bucket
Resources:
  MyLandingZone:
    Type: 'AWS::ControlTower::LandingZone'
    Properties:
      Version:
        Ref: Version
      Tags:
        - Key: "keyname1"
          Value: "value1"
        - Key: "keyname2"
          Value: "value2"
      Manifest:
        governedRegions:
          Ref: GovernedRegions
        organizationStructure:
          security:
            name:
              Ref: SecurityOuName
          sandbox:
            name:
              Ref: SandboxOuName
        centralizedLogging:
          accountId:
            Ref: CentralizedLoggingAccountId
          configurations:
            loggingBucket:
              retentionDays:
                Ref: LoggingBucketRetentionPeriod
            accessLoggingBucket:
              retentionDays:
                Ref: AccessLoggingBucketRetentionPeriod
            kmsKeyArn:
              Ref: KMSKey    
          enabled: true
        securityRoles:
          accountId:
            Ref: SecurityAccountId
        accessManagement:
          enabled: true
```

# Manage an existing landing zone using CloudFormation
<a name="lz-apis-cfn-launch-existing"></a>

You can use CloudFormation to manage a landing zone that you have already launched by importing the landing zone in a new or existing CloudFormation stack. Review [ Bringing existing resources into CloudFormation management](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resource-import.html) for details and instructions. 

To [detect and resolve drift within a landing zone](https://docs.aws.amazon.com/controltower/latest/userguide/drift.html), you can use the AWS Control Tower console, the AWS CLI, or the [`ResetLandingZone` API](lz-api-reset.md). 

# Next steps
<a name="getting-started-next"></a>

Now that your landing zone is set up, it's ready for use.

To learn more about how you can use AWS Control Tower, see the following topics:
+ For recommended administrative practices, see [Best Practices](https://docs.aws.amazon.com//controltower/latest/userguide/best-practices.html).
+ You can set up IAM Identity Center users and groups with specific roles and permissions. For recommendations, see [Recommendations for setting up groups, roles, and policies](roles-recommendations.md).
+ To begin enrolling organizations and accounts from your AWS Organizations deployments, see [Govern existing organizations and accounts](https://docs.aws.amazon.com//controltower/latest/userguide/importing-existing.html).
+ Your end users can provision their own AWS accounts in your landing zone using Account Factory. For more information, see [Permissions for configuring and provisioning accounts](account-factory.md#configure-provision-new-account).
+ To assure [Compliance Validation for AWS Control Tower](compliance-validation.md), your central cloud administrators can review log archives in the Log Archive account, and designated third-party auditors can review audit information in the Audit (shared) account, which is a member of the Security OU. 
+ To learn more about the capabilities of AWS Control Tower, see [Related information](https://docs.aws.amazon.com//controltower/latest/userguide/related-information.html).
+ From time to time, you may need to update your landing zone to get the latest backend updates, the latest controls, and to keep your landing zone up-to-date. For more information, see [Configuration update management in AWS Control Tower](configuration-updates.md).
+ If you encounter issues while using AWS Control Tower, see [Troubleshooting](troubleshooting.md).

**Important**  
If you have not yet enabled MFA for your account's root user, do so now. For more information about best practices for the root user, see [Best practices to protect your account's root user](https://docs.aws.amazon.com//accounts/latest/reference/best-practices-root-user.html#bp-root-limit-tasks).