Build a Multi-Account Management Environment with AWS Control Tower
Tags: aws, controltower, organizations, awssso
Published: 2022-07-13 11:50:31

![img](https://day-journal.com/memo/images/logo/aws/controltower.png)

### I built a multi-account management environment with AWS Control Tower :tada:  

<br>

[AWS Control Tower](https://aws.amazon.com/controltower) is a service that allows you to build a secure AWS multi-account management environment. Since [AWS Organizations](https://aws.amazon.com/organizations) and [AWS SSO](https://aws.amazon.com/single-sign-on) are set up automatically, it is easier than manually creating accounts. I have used this service at my company and found it convenient, so I decided to use it for my account this time. In my account, I have additionally built and managed production, staging, development, and test environments :thumbsup: 

<br>

The following details are explained below.

- Landing zone settings
- Adding Accounts
- SSO connection confirmation

<br>

Advance Preparation

- Prepare two email addresses for new accounts.
- Prepare email addresses for additional accounts. In this case, prepared four additional ones separately.

<br>

## Landing Zone Settings

How to set up a landing zone in AWS Control Tower.

Login with the root account → AWS Management Console → Control Tower.
![img](https://day-journal.com/memo/images/aws-controltower-001_01.png)

Click on "Configure Landing Zone."
![img](https://day-journal.com/memo/images/aws-controltower-001_02.png)

Set Home Region, Region Deny, and Additional Regions → Click "Next."
![img](https://day-journal.com/memo/images/aws-controltower-001_03.png)

Configure the basic OU and additional OUs as they are → Click "Next."
![img](https://day-journal.com/memo/images/aws-controltower-001_04.png)

Configure Log Archive Account and Audit Account → Click "Next." Specify the two email addresses you have prepared in advance here.
![img](https://day-journal.com/memo/images/aws-controltower-001_05.png)

Confirm settings → Click "Set Landing Zone."
![img](https://day-journal.com/memo/images/aws-controltower-001_06.png)

Wait a few minutes for the environment to be set up.
![img](https://day-journal.com/memo/images/aws-controltower-001_07.png)

When completed, three accounts will be created: a root account, a log archive account, and an audit account.
![img](https://day-journal.com/memo/images/aws-controltower-001_08.png)

This configuration will create a root account, a log archive account, and an audit account with various settings!

<br>

## Adding Accounts

Here is how to add an account in AWS Control Tower.

Click on “Account Factory” → "Create Account."
![img](https://day-journal.com/memo/images/aws-controltower-002_01.png)

Set account email address, display name, SSO email address, SSO user name, and organizational unit → Click "Create Account."
![img](https://day-journal.com/memo/images/aws-controltower-002_02.png)

Account → Addition is complete when the status is displayed as registered.
![img](https://day-journal.com/memo/images/aws-controltower-002_03.png)

You can create an account for each environment for multi-account management!

<br>

## SSO Connection Confirmation

This is how to confirm SSO connection on AWS Control Tower.

Click on “Users and Access” → "User Portal URL." This will be the SSO URL you will use for future logins.
![img](https://day-journal.com/memo/images/aws-controltower-003_01.png)

Enter user, password, MFA, etc. → The login destination for the account you created will be displayed.
![img](https://day-journal.com/memo/images/aws-controltower-003_02.png)

SSO will also be set up so you can easily log in to each account!

<br>

Control Tower makes it easy to implement secure multi-account management, so give it a try! Integrating existing accounts was a bit of a challenge...

<br>

References
[AWS Control Tower](https://aws.amazon.com/controltower)