Control Tower and Security Hub

I’d like to expand on my previous comment after speaking with the AWS Control Tower team. The solution really depends on your specific use case.

In highly secure environments where Control Tower's native controls are not sufficient, it is absolutely valid to manage AWS Security Hub centrally and independently of Control Tower, as I previously described. There is no technical conflict as long as you have no intention of using Control Tower to enable and manage Security Hub controls.

By default, Control Tower enables a standard in Security Hub that includes only a subset of the AWS Foundational Security Best Practices. In environments that require strict adherence to frameworks like NIST 800-53, this is often inadequate. Furthermore, Control Tower does not currently offer the flexibility to automate or suppress findings at scale within Security Hub, nor can you enable Security Hub controls in the Security OU through Control Tower. These limitations can make it impractical for certain organizations with more advanced compliance needs. As a result, managing the NIST standard directly within Security Hub—outside of Control Tower—is often the more viable approach.

A few caveats to be aware of:

• Once you choose to manage Security Hub independently, you won’t be able to re-enable its controls through Control Tower. That said, this is generally acceptable if you’ve made an intentional decision to operate outside the Control Tower framework for any non-mandatory controls.

• If you are using the Landing Zone Accelerator, it will attempt to manage Security Hub through Control Tower by default. However, this can be overridden by implementing your own custom stacks.

AWS Support does not typically provide detailed guidance on this topic, other than what I was told by them initially and what the answer was here. I understand why but sometimes you need to dig deeper. I had to speak directly with someone on the Control Tower team to gain deeper insights. Ultimately, the answer is not straightforward—it really depends on the environment and specific compliance or security posture required. The main point in all this is that it is fine to use Security Hub independently in an environment with Control Tower as long as you are aware of the tradeoffs.

Side Note: There are also recurring issues with Control Tower not fully complying with certain frameworks in the resources it provisions, particularly in the Security and Management accounts. For example, the default S3 buckets or SNS topics may lack customer-managed keys (CMKs), which often raises concerns with internal risk and security teams. While there are compensating controls in place, these gaps can be frustrating to explain and justify.

I hope this helps others who are navigating similar questions. It's been a bit of a journey to uncover these details, especially since much of this information isn’t well-documented. As always, you learn the most by building, experimenting, and observing how different architectural patterns behave in real-world environments. As a consultant, I get to see a wide range of use cases and approaches, which helps shape this perspective.

Best regards, Andy