AWS Control Tower Goes GA (June 2019): Guardrails for Multi-Account AWS

Retrospective: this article looks back at events from June 2019, written in 2026 with the benefit of hindsight.

In June 2019, AWS Control Tower became generally available. It automated the creation of a secure multi-account AWS environment — a landing zone — with guard rails applied from day one.

What Control Tower set up

• An AWS Organizations structure with a management account and core organizational units.
• A Log Archive account receiving CloudTrail and AWS Config logs from all accounts.
• An Audit (security) account for cross-account security access.
• AWS SSO (now IAM Identity Center) for central user access.
• An Account Factory to create new accounts with the baseline already applied.
• Guard rails: preventive (implemented as SCPs) and detective (implemented as AWS Config rules), such as disallowing changes to CloudTrail or detecting public S3 buckets.

Why it mattered

AWS had recommended multi-account architecture for years, but building one by hand required deep expertise. Control Tower packaged the pattern so mid-sized teams could adopt it in days rather than months.

Limitations early on

The first version was best suited to new environments; enrolling existing accounts and organizations improved over time. Customization required additional tooling such as Customizations for Control Tower or Account Factory for Terraform.

In hindsight

Control Tower evolved its guard rails into a large library of controls — preventive, detective and proactive — mapped to frameworks. For most organizations starting or reorganizing on AWS, it remains the fastest path to a structure aligned with the AWS Security Reference Architecture. The organizations that struggled most were those that delayed: retrofitting a sprawling single account is far harder than starting structured.