How should I configure resources in a Control Tower Managed/created account ?

Question

**Problem**:
I have a AWS environment that utilizes Control Tower, it previously automatically created a Log Archive Account. Within this account.

I need to modify the existing Control Tower S3 bucket log S3 bucket policy so this bucket can send to an SQS queue for our SIEM service as well as receive get requests from our SIEM service.

I also need to configure 2 new S3 buckets and configure them to receive VPC flow logs and CW logs. Each with it's own Bucket.

**Proposed Solution:**
I've read AWS Documentation that it recommends not manually changing things in Control Tower created resources. So because of this, I was trying to deploy it via CF and researched CfCT

What I do not understand is where in the AWS Console. What this be done in the same way that I would configure any other CF template? How would I be able to distinguish from if it's regular CF or CfCt.

What's the best way to achieve this and if there's any better way given my use case, what would hat be?

Matt Barbieri · Accepted Answer

Hi There,

You have a couple of options for managing CloudTrail logs in your Control Tower environment.  Neither one requres using CfCt.   Changing the bucket policy of the Control Tower-managed S3 bucket is not recommended because Control Tower treats these resources as managed infrastructure, and your changes can get reverted during landing zone updates or drift remediation.

Option 1: S3 Replication with Event Notifications (Recommended) -

Set up S3 replication from the Control Tower-managed log archive bucket to a separate bucket that you fully control:

* Configure replication to copy logs to your own S3 bucket in near real-time
* Apply a short lifecycle policy on the replicated bucket if needed
* Set up S3 event notifications on your bucket to trigger messages to your SQS queue
* Configure your SIEM service to consume from this SQS queue and read from your bucket
* This approach keeps the Control Tower bucket untouched while giving you full control over the replicated data

Option 2: Custom Organization Trail (More Control) -

Manage CloudTrail independently outside of Control Tower's automated setup :

* Create your own organization-level trail that logs events across all accounts
* Configure centralized logging to an S3 bucket you fully manage
* Set up the bucket policy, SQS queue, and SIEM integration as needed
* Trade-off: This requires more manual setup and ongoing management, but gives you complete control

For the centralized VPC Flow logs and CW logs, you can create 2 new bukets in the log archive account for this purpose, but you still need to configure the VPC's and CW service in each account to write to that centralized bucket.  You can use CfCT for this

LeanIT · Answer

I ran your requirements through Nexus, our AI support assistant, which pulled the following guidance directly from the AWS Well-Architected Framework documentation. Here is the recommended approach for your multi-account logging architecture:

Based on the AWS Well-Architected Framework documentation, here is guidance for your multi-account logging architecture:

## S3 Bucket Policy Modifications for Log Archive Account

According to the documentation, when managing logs in a dedicated log archive account (such as the one created by AWS Control Tower), you should:

**Use Amazon S3 bucket policy controls to enforce secure access to data.** When configuring access for your SIEM service, you'll need to update the bucket policy to:
- Allow the SQS queue to receive notifications from the S3 bucket
- Grant GET object permissions to your SIEM service's IAM role or external principal

**Important Security Considerations:**
- **Turn off ACLs for your Amazon S3 buckets and use IAM policies to define access control** instead
- Use **AWS IAM Access Analyzer** to analyze your S3 bucket policies and generate findings when a policy grants access to an external entity
- Consider using **VPC endpoint policies and the aws:PrincipalOrgId condition** to ensure the identities accessing your Amazon S3 buckets belong to your organization as part of your data perimeter strategy

## New S3 Buckets for VPC Flow Logs and CloudWatch Logs

The documentation recommends:

**For VPC Flow Logs:**
- AWS recommends streaming VPC Flow Logs to either an Amazon S3 bucket or a CloudWatch log group
- You can be selective on how and where you use Flow Logs to reduce cost
- VPC Flow Logs are one of the basic logging sources to support security investigations in AWS

**For Log Storage:**
- **Amazon S3 provides cost-effective, durable storage with an optional lifecycle policy**
- Logs stored in Amazon S3 buckets can be queried using services such as Amazon Athena
- **For long retention periods, it is recommended to use Amazon S3** for its cost effectiveness and flexible lifecycle capabilities

## Cross-Account Access Configuration

When configuring tools (like your SIEM) to access your standardized log locations:
- **Configure these tools to operate out of a Security Tooling account with cross-account read access to the Log Archive account** where applicable
- If using AWS Control Tower, CloudTrail is enabled by default and sends logs to an S3 bucket in the dedicated log archive account

## Audit and Monitoring

After making these changes:
- **Use AWS CloudTrail to log the API calls made to your Amazon S3 buckets and objects** to audit your environment
- Consider using **auto-remediation in AWS Config** to respond to changes in public access configuration of your S3 buckets
- **Enable CloudTrail for any emergency access scenarios** and send trail

How should I configure resources in a Control Tower Managed/created account ?

S3 Bucket Policy Modifications for Log Archive Account

New S3 Buckets for VPC Flow Logs and CloudWatch Logs

Cross-Account Access Configuration

Audit and Monitoring

Add your answer

Relevant content