Avoiding duplicative CW and CT logs when registering an account to Control Tower

0

I currently have multiple AWS accounts under a single OU. I want to launch Control Tower in a NEW management account, and then register the existing OU to the Control Tower. What will happen to the existing Cloud Watch and Cloud Trail configurations on my accounts when their OU joins Control Tower? As I understand it, the same trails will be routed to the centralized logging account. Do I need to then manually disable the OU / account level CW and CT configurations I previously created? Is there best-practice guidance on this aspect of OU / account registration?

AWS
lovjim
已提問 7 個月前檢視次數 204 次
1 個回答
0
已接受的答案

I want to launch Control Tower in a NEW management account, and then register the existing OU to the Control Tower.

This will mean that the accounts you want to enroll in AWS Control Tower will have to leave your current AWS Organization and if you have existing account-level CloudTrail, it would still be enabled and still work after leaving your current AWS Organization and joining the AWS Organization of the new management account.

There are separate Amazon CloudWatch Log Groups set up by AWS Control Tower which will not impact your existing CloudWatch configurations. You can review the mandatory controls from Control Tower

When you configure Control Tower, you will Optionally configure AWS CloudTrail. If you have chosen for AWS Control Tower to create your organizational-level trail or you create it yourself, then you will be subject to additional charges for Cloud Trail duplicate management events. You should just choose either organizational-level Cloudtrail or account-level CloudTrail.

AWS
Chan_N
已回答 7 個月前
profile picture
專家
已審閱 2 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南