Control Tower Audit account

The audit account is an account that is automatically added when ControlTower is activated.
I thought it would be difficult to create this for each OU.
https://docs.aws.amazon.com/controltower/latest/userguide/how-control-tower-works.html#what-is-audit

The audit account is a restricted account that's designed to give your security and compliance teams read and write access to all accounts in your landing zone. From the audit account, you have programmatic access to review accounts, by means of a role that is granted to Lambda functions only. The audit account does not allow you to log in to other accounts manually. For more information about Lambda functions and roles, see Configure a Lambda function to assume a role from another AWS account.

yes but it becomes a bit of a manual process. As the audit account is a restricted account that's designed to give your security and compliance teams read and write access to all accounts in your landing zone. . You would also need to ensure that you create the resources required in the new audit account that are specific for accounts in the new OU. https://docs.aws.amazon.com/controltower/latest/userguide/how-control-tower-works.html#what-shared Additionally, you will need to use a solution like CfCT to apply changes to the OU and the accounts within it that are specific to the 2nd audit account. You can also create new trails if. The issue is that there would be duplication. Another option would be to simply have an OU created in organizations and not managed by CT... you can apply the same principles manually and not have duplication.