AWS Control Tower Best Practices

Question

Hi, I am studying the AWS Control Tower and managed to provisioned it on my personal environment and I am seeking your expertise in managing the accounts.

I have assigned an Administrator (gave AdministratorAccess) to be able to manage the member accounts.

Question I have are the following:

1.) I would like to view the CloudTrail from the Log Archive Account to monitor the users and events within my Control Tower. I am encountering the error "Invalid information in one or more fields. Check your information or contact your administrator." when switching (assumeRole) role to the aws-controltower-AdministratorExecutionRole. Am I allowed to assume the role or prohibited by the applied GuardRails.

2.) Do you recommend a different approach when viewing/reviewing the events within my environment.

Thank you.

Steve_M · Answer

> Am I allowed to assume the role or prohibited by the applied GuardRails.

That depends what's in the GuardRails (by which I'm guessing you mean SCPs) that are applied to the Log Archive Account. You can view these from the AWS Organizations management account in AWS Console -> Organizations -> AWS accounts and then finding the Log Archive account. Look in the **Policies** tab to see what SCPs are applied.

There's a very in-depth look at AWS Control Tower Execution Roles and how they can (and can't) be assumed here https://docs.aws.amazon.com/controltower/latest/userguide/roles-how.html

AWS Control Tower Best Practices

Add your answer

Relevant content