# AWS Control Tower sets up a multi-account landing zone automatically
# Prerequisites: new AWS account or existing with minimal config

# Control Tower creates:
# - Management account (root of organization)
# - Log Archive account (centralized S3 for CloudTrail/Config logs)
# - Audit account (read-only access for security tools)
# - Core OUs: Security, Sandbox

# Enrolling existing accounts/OUs is primarily an Account Factory / console
# workflow, not a single direct CLI subcommand *(needs verification --
# check the current AWS CLI controltower command reference for what's
# actually scriptable)*

# Account Factory: self-service account creation
# Configured via Service Catalog in Control Tower console
# Outputs a new account with: SSO access, CloudTrail, Config, GuardDuty, Security Hub

# Guardrails (preventive SCPs + detective Config rules)
aws controltower list-enabled-controls \
  --target-identifier arn:aws:organizations::$MGMT_ACCT:ou/$OU_ID

# Add custom Control Tower controls
aws controltower enable-control \
  --control-identifier arn:aws:controltower:us-east-1::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED \
  --target-identifier arn:aws:organizations::$MGMT_ACCT:ou/$OU_ID

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PreventLeavingOrg",
      "Effect": "Deny",
      "Action": ["organizations:LeaveOrganization"],
      "Resource": "*"
    },
    {
      "Sid": "RestrictRegions",
      "Effect": "Deny",
      "NotAction": [
        "iam:*", "organizations:*", "support:*", "budgets:*",
        "route53:*", "cloudfront:*", "waf:*", "sts:*"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:RequestedRegion": ["ap-south-1", "us-east-1"]
        }
      }
    },
    {
      "Sid": "PreventDisablingSecurityServices",
      "Effect": "Deny",
      "Action": [
        "cloudtrail:StopLogging", "cloudtrail:DeleteTrail",
        "guardduty:DeleteDetector", "config:DeleteConfigRule",
        "securityhub:DisableSecurityHub"
      ],
      "Resource": "*"
    }
  ]
}