本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 在共享账户中创建的资源
<a name="shared-account-resources"></a>

本部分介绍在您设置登录区时 AWS Control Tower 在共享账户中创建的资源。

有关成员账户资源的信息，请参阅 [Account Factory 的资源注意事项](account-factory-considerations.md)。

## 管理账户资源
<a name="mgmt-account-resouces"></a>

设置 landing zone 时，将在您的管理账户中创建以下 AWS 资源。


| AWS 服务 | 资源类型 | 资源名称 | 
| --- | --- | --- | 
| AWS Organizations | 账户 | audit<br />log archive | 
| AWS Organizations | OU | Security<br />Sandbox | 
| AWS Organizations | 服务控制策略 | aws-guardrails-\* | 
| AWS CloudFormation | 堆栈 | AWSControlTowerBP-BASELINE-CLOUDTRAIL-MASTER<br />AWSControlTowerBP-BASELINE-CONFIG-MASTER（在 2.6 及更高版本中；未在 4.0 及更高版本中部署） | 
| AWS CloudFormation | StackSets | AWSControlTowerBP-BASELINE-CLOUDTRAIL（在版本 3.0 及更高版本中未部署）<br />AWSControlTowerBP\_BASELINE\_SERVICE\_LINKED\_ROLE (Deployed in 3.2 and later)<br />AWSControlTowerBP-BASELINE-CLOUDWATCH<br />AWSControlTowerBP-BASELINE-CONFIG<br />AWSControlTowerBP-BASELINE-ROLES<br />AWSControlTowerBP-BASELINE-SERVICE-ROLES<br />AWSControlTowerBP-SECURITY-TOPICS<br />AWSControlTowerLoggingResources<br />AWSControlTowerSecurityResources<br />AWSControlTowerExecutionRole<br />AWSControlTowerBP-CONFIG-CENTRAL-S3-BUCKET（在 4.0 及更高版本中部署） | 
| AWS Service Catalog | 产品 | AWS Control Tower Account Factory | 
| AWS Config | 聚合器 | aws-controltower-ConfigAggregatorForOrganizations（未在 4.0 及更高版本中部署） | 
| AWS CloudTrail | 试用 | aws-controltower-BaselineCloudTrail | 
| 亚马逊 CloudWatch | CloudWatch 日志 | aws-controltower/CloudTrailLogs | 
| AWS Identity and Access Management | 角色 | AWSControlTowerAdmin<br />AWSControlTowerStackSetRole<br />AWSControlTowerCloudTrailRolePolicy | 
| AWS Identity and Access Management | 策略 | AWSControlTowerServiceRolePolicy<br />AWSControlTowerAdminPolicy<br />AWSControlTowerCloudTrailRolePolicy<br />AWSControlTowerStackSetRolePolicy | 
| AWS IAM Identity Center | 目录组 | AWSAccountFactory<br />AWSAuditAccountAdmins<br />AWSControlTowerAdmins<br />AWSLogArchiveAdmins<br />AWSLogArchiveViewers<br />AWSSecurityAuditors<br />AWSSecurityAuditPowerUsers<br />AWSServiceCatalogAdmins | 
| AWS IAM Identity Center | 权限集 | AWSAdministratorAccess<br />AWSPowerUserAccess<br />AWSServiceCatalogAdminFullAccess<br />AWSServiceCatalogEndUserAccess<br />AWSReadOnlyAccess<br />AWSOrganizationsFullAccess | 

**注意**  
未在 CloudFormation StackSet `BP_BASELINE_CLOUDTRAIL` landing zone 版本 3.0 或更高版本中部署。但是，在您更新登录区之前，它会继续存在于早期版本的登录区中。  
自 2025 年 6 月起，AWS Control Tower 将侦探控制作为服务相关 AWS Config 规则直接部署到注册账户中，而不是通过注册账户部署。 CloudFormation StackSets不再部署 StackSets`AWSControlTowerGuardrailAWS-GR-AUDIT-BUCKET-PUBLIC-READ-PROHIBITED``AWSControlTowerGuardrailAWS-GR-AUDIT-BUCKET-PUBLIC-WRITE-PROHIBITED`和及其关联的堆栈实例。有关更多信息，请参阅对[作为服务相关的 AWS Config 规则部署的侦探控件的支持](https://docs.aws.amazon.com/controltower/latest/userguide/2025-all.html#managed-config-controls)。

## 日志存档账户资源
<a name="log-archive-resources"></a>

设置 landing zone 时，将在您的日志存档账户中创建以下 AWS 资源。


| AWS 服务 | 资源类型 | 资源名称 | 
| --- | --- | --- | 
| AWS CloudFormation | 堆栈 | StackSet-AWSControlTowerBP-BASELINE-CLOUDWATCH-<br />StackSet-AWSControlTowerBP-BASELINE-CONFIG-<br />StackSet-AWSControlTowerBP-BASELINE-CLOUDTRAIL-<br />StackSet-AWSControlTowerBP-BASELINE-SERVICE-ROLES-<br />StackSet-AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE-(In 3.2 and later)<br />StackSet-AWSControlTowerBP-BASELINE-ROLES-<br />StackSet-AWSControlTowerLoggingResources- | 
| AWS Config | AWS Config 规则 | AWSControlTower\_AWS-GR\_AUDIT\_BUCKET\_PUBLIC\_READ\_PROHIBITED<br />AWSControlTower\_AWS-GR\_AUDIT\_BUCKET\_PUBLIC\_WRITE\_PROHIBIT | 
| AWS CloudTrail | 跟踪 | aws-controltower-BaselineCloudTrail | 
| 亚马逊 CloudWatch | CloudWatch 赛事规则 | aws-controltower-ConfigComplianceChangeEventRule | 
| 亚马逊 CloudWatch | CloudWatch 日志 | /aws/lambda/aws-controltower-NotificationForwarder | 
| AWS Identity and Access Management | 角色 | aws-controltower-AdministratorExecutionRole<br />aws-controltower-CloudWatchLogsRole<br />aws-controltower-ConfigRecorderRole<br />aws-controltower-ForwardSnsNotificationRole<br />aws-controltower-ReadOnlyExecutionRole<br />AWSControlTowerExecution | 
| AWS Identity and Access Management | 策略 | AWSControlTowerServiceRolePolicy | 
| Amazon Simple Notification Service | 主题 | aws-controltower-SecurityNotifications | 
| AWS Lambda | 应用程序 | StackSet-AWSControlTowerBP-BASELINE-CLOUDWATCH-\* | 
| AWS Lambda | 函数 | aws-controltower-NotificationForwarder | 
| Amazon Simple Storage Service | 存储桶 | aws-controltower-logs-\*<br />aws-controltower-s3-access-logs-\* | 

## 审计账户资源
<a name="audit-account-resources"></a>

设置 landing zone 时，将在您的审核账户中创建以下 AWS 资源。


| AWS 服务 | 资源类型 | 资源名称 | 
| --- | --- | --- | 
| AWS CloudFormation | 堆栈 | StackSet-AWSControlTowerBP-BASELINE-CLOUDWATCH-<br />StackSet-AWSControlTowerBP-BASELINE-CONFIG-<br />StackSet-AWSControlTowerBP-BASELINE-CLOUDTRAIL-<br />StackSet-AWSControlTowerBP-BASELINE-SERVICE-ROLES-<br />StackSet-AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE-(In 3.2 and later)<br />StackSet-AWSControlTowerBP-SECURITY-TOPICS-<br />StackSet-AWSControlTowerBP-BASELINE-ROLES-<br />StackSet-AWSControlTowerSecurityResources-\*<br />StackSet-AWSControlTowerBP-CONFIG-CENTRAL-S3-BUCKET-（在 4.0 及更高版本中部署） | 
| AWS Config | 聚合器 | aws-controltower-GuardrailsComplianceAggregator（未在 4.0 及更高版本中部署） | 
| AWS Config | 聚合器 | aws-controltower-ConfigAggregatorForOrganizations（在 4.0 及更高版本中部署） | 
| AWS Config | AWS Config 规则 | AWSControlTower\_AWS-GR\_AUDIT\_BUCKET\_PUBLIC\_READ\_PROHIBITED<br />AWSControlTower\_AWS-GR\_AUDIT\_BUCKET\_PUBLIC\_WRITE\_PROHIBITED | 
| AWS CloudTrail | 试用 | aws-controltower-BaselineCloudTrail | 
| 亚马逊 CloudWatch | CloudWatch 赛事规则 | aws-controltower-ConfigComplianceChangeEventRule | 
| 亚马逊 CloudWatch | CloudWatch 日志 | /aws/lambda/aws-controltower-NotificationForwarder | 
| AWS Identity and Access Management | 角色 | aws-controltower-AdministratorExecutionRole<br />aws-controltower-CloudWatchLogsRole<br />aws-controltower-ConfigRecorderRole<br />aws-controltower-ForwardSnsNotificationRole<br />aws-controltower-ReadOnlyExecutionRole<br />aws-controltower-AuditAdministratorRole<br />aws-controltower-AuditReadOnlyRole<br />AWSControlTowerExecution | 
| AWS Identity and Access Management | 策略 | AWSControlTowerServiceRolePolicy | 
| Amazon Simple Notification Service | 主题 | aws-controltower-AggregateSecurityNotifications<br />aws-controltower-AllConfigNotifications<br />aws-controltower-SecurityNotifications | 
| AWS Lambda | 函数 | aws-controltower-NotificationForwarder | 
| Amazon Simple Storage Service | 存储桶 | aws-controltower-config-logs-\*（在 4.0 及更高版本中部署）<br />aws-controltower-config-access-logs-\*（在 4.0 及更高版本中部署） |