AWS Control Tower Reviews

It stands out as a valuable service due to its extensive capabilities, including predefined, detective, and preventive guardrails. It eliminates the need to scour a catalog for services, making tasks like creating custom Amazon Machine Images (AMIs) straightforward for developers. It streamlines the process of setting up and managing management accounts within my organization due to its well-structured integration of various services and functionalities.

I currently oversee data management within our organization, which includes the administration of various data accounts. This involves the ability to seamlessly switch between different accounts to ensure efficient management, which is particularly useful for managing a diverse set of accounts created to serve various purposes within our organization. The robust security features provided by AWS Control Tower play a crucial role in ensuring the integrity and protection of our data.

One noteworthy aspect of AWS Config and Service Control Policies (SCPs) is the effectiveness of SCPs in defining and enforcing restrictions within the AWS environment. When SCPs are applied, they serve as preventive measures by limiting certain actions and behaviors within the environment. Instead of merely granting a user a broad set of privileges, SCPs allow for a more fine-grained approach. You can specify which AWS services a user is permitted to access, aligning permissions precisely with the daily tasks they need to perform. This level of control ensures that access is tailored to the specific requirements of the user's role and responsibilities.

When it comes to security in the ever-evolving AWS landscape, it's a constant challenge because Amazon keeps introducing new features and services regularly. I would suggest improvement regarding the ongoing pursuit of enhanced security within the Control Tower environment. This means continuously refining and fortifying the service to ensure that it meets the stringent security requirements of both large, established organizations and those newcomers venturing into the cloud for the first time. It would be beneficial if AWS offered the capability to seamlessly deploy your infrastructure to another region to ensure continuous availability and redundancy.

I have been working with it for four years.

I would rate its stability capabilities quite highly, perhaps a nine out of ten. While it's an excellent service overall, there have been instances where certain services experienced temporary disruptions due to factors like regional availability.

Scalability remains a key priority, as it caters to the diverse needs of AWS users, regardless of their organization's size or level of cloud adoption. I would rate it ten out of ten.

The customer support has been consistently excellent. I would rate it ten out of ten.

When establishing your landing zone, you start by creating your accounts, including Organizational Units (OUs) and Core accounts. After that, you simply organize your accounts according to your needs within the OUs and manage them accordingly. This streamlined approach makes the initial setup of Control Tower quite user-friendly and efficient.

The ROI is undeniably excellent. It offers significant value by simplifying the management of multiple AWS accounts effectively. Moreover, from a security perspective, it empowers you to organize your accounts within the organization and implement preventive guardrails using Service Control Policies (SCPs) and AWS Config. These preventive measures and detection mechanisms play a crucial role in safeguarding your organization against attacks and ensuring you have visibility into the activities occurring within your environment.

The pricing structure is closely intertwined with the specifics of your environment and the billing strategy you employ. One notable feature that plays a significant role in pricing is AWS Hub, which offers consolidated billing, so instead of each individual account in your organization being billed separately, you can group them together and it typically results in reduced pricing.

I would strongly recommend AWS Control Tower, especially for companies with large, complex organizations or enterprises. This service is particularly beneficial when dealing with various organizational units within your company as it allows for efficient structuring and categorizing of these units and places the associated accounts accordingly. One of the standout advantages is the fine-grained control it offers in terms of permissions and privileges. You can tailor access to specific AWS resources based on the job functions and responsibilities of users or accounts. From a security perspective, it excels in providing robust controls and access management. I would rate it ten out of ten.

When we took on that project, the client had various business units within their organization, including a BI unit, an engineering unit, and other units related to development and different business functions. They also had a centralized IT team responsible for cloud operations. Initially, their AWS environment was highly decentralized, lacking a centralized management system. They approached us to establish a centralized solution that could handle tasks like creating new AWS accounts based on business needs and enforcing baseline security standards. To address their requirements, we engaged with AWS and, after discussing their needs, concluded that migrating to AWS Control Tower would be the most suitable solution. In addition to Control Tower, we set up a centralized networking system to provide controlled access to new accounts. This approach centralized authentication and access management, simplifying operations. We also implemented various guardrails, as their previous setup lacked mechanisms for account owners to identify and adhere to best practices. After implementation, we organized the AWS organization structure based on their business units, each with its set of preventive and detective guardrails. This allowed for a more structured and controlled environment.

When we compare it to the earlier approach of setting up from scratch, the solution proved to be highly valuable. With Control Tower, there are ready-to-use automated templates available, simplifying the implementation of a centralized management solution. We have approximately three hundred managed AWS rules that are common to Control Tower, which is a significant advantage. This means we no longer have to write complex Python code, as it is all managed for us. When we need to provision a new AWS account or establish specific guardrails and baselines, Control Tower offers an excellent option. Previously, if we had to create a new account, we had to set up the foundational networking components manually, including writing templates for VPCs, subnets, and more. With Control Tower, it became remarkably easy to configure these baseline networking components for a new AWS account.

It is undoubtedly a growing service, and it's evident that AWS is continuously working to improve it. However, some challenges do arise when it comes to migrating existing accounts that are not yet under Control Tower into the system. This process often involves creating specific roles manually, and it can be somewhat tedious and there isn't a readily available set of guidelines for this process. It requires some searching and digging through to find the necessary information. It is essential to clarify that this isn't necessarily a drawback of the service, but having a clear and concise set of predefined guidelines from AWS for moving existing accounts under AWS Control Tower would be highly beneficial as it would simplify the process and make it more user-friendly. 

We used it for a couple of months.

When setting up from scratch, stability isn't usually a major concern as you're starting with a clean slate. The real challenges arise when you have existing accounts that aren't integrated with Control Tower. Achieving stability in such cases can be a bit of a struggle, as it often involves navigating complex configurations and adjustments to align those accounts with Control Tower's framework. I would rate it seven out of ten.

During our discussions, we learned that AWS Control Tower initially allows you to launch it in a single region for each account. This limitation posed a challenge because it doesn't inherently provide high availability across multiple regions. When we inquired with AWS, they confirmed that at the time, they primarily operate within a single region, even though you can manage multiple regions within that account. While this setup can be highly available within that single region, it presents some complexities when aiming for broader geographical coverage. It does offer scalability, and it can manage a substantial number of accounts. To the best of my knowledge, it supports up to around two hundred to two hundred fifty accounts. I would rate it eight out of ten.

We didn't encounter significant issues, especially since the authentication was handled by us, as a partner.

We were previously using AWS landing zone, and managing it was relatively straightforward. There was a significant amount of configuration required. We had to set up the AWS organization separately, and there were various aspects to manage under different categories. Control Tower simplifies the management of these interconnected components, making it more efficient and user-friendly.

The initial setup was straightforward. I began using it for the first time last year, and I found it to be an easy and user-friendly tool.

It took approximately one to one and a half hours to set up the basic configuration, while the entire project spanned about six months. This extended timeline was due to various additional tasks we needed to address. We had to centralize networking, establish a centralized firewall, manage ingress and egress controls, and handle a range of other requirements.

I would say it is average. It operates on a pay-as-you-go model, meaning we are charged only for the services we actively use within it.

It is a highly commendable product. It significantly enhances the management of multi-account architectures. It stands out as one of the best products AWS has introduced in recent years. I'm confident that AWS will continue to make enhancements, possibly expanding support to additional regions and introducing more managed rules to seamlessly align with evolving business needs. I would rate it eight out of ten.

We have two types of customers: those who are new to AWS and are onboarding for the first time, and those who are already using AWS but have not opted for Control Tower. The second group is now implementing virtual data to enhance policy governance and create landing zones. 

It is noted that policies created manually based on administrator or security recommendations may lack consideration for other parameters. Control Tower aims to address these concerns and offer optimal features, including database and policies, to assist customers in implementing policy-driven governance extensively within their organization.

It offers automated recommendations for security and policies, creating a landing zone and providing a list of policies. Customers can also add their policies and access helpful templates.

It could be improved by having a more intuitive graphical interface. It could also include other coding languages like PowerShell and Python, as it would be beneficial for DevOps recommendations. Having the capability to create architectural designs in a diagram format while creating the landing zone would help showcase the design to higher-level stakeholders.

I have over five years of experience with AWS Control Tower implementation.

It offers great stability.

It is scalable and can be easily customized based on specific requirements. If the number of workloads increases in the future, the landing zone can expand to accommodate the additional workload.

I also use Microsoft Azure, which has its cloud framework and can be implemented alongside AWS. It is easier to use and offers better due diligence, but AWS has a greater number of resources and services available. Choosing between the two platforms depends on factors such as application load, design, and pricing.

The initial setup was quite easy.8

Once AWS Control Tower is enabled, it automatically creates the landing zone and presents policies for the customers to review and agree upon. The implementation process is intuitive, automated, and can be managed by one or two people. The time required for implementation varies, but for small organizations, it typically takes half an hour. When it's implemented, it does not require regular maintenance unless further customizations are needed for infrastructure.

There is a noticeable benefit from implementing AWS, as we heard from various customers. While the cost may be higher compared to on-premise data centers, the services and facilities provided by AWS greatly contribute to the success and value of the businesses. 

The cost is reasonable, but there are opportunities for improvement in terms of pricing for larger enterprises. As organizations accumulate costs for numerous services, it can become a significant amount so reducing these costs would be beneficial.

I highly recommend AWS Control Tower as it is a valuable tool for both first-time and long-term AWS adopters. It helps to manage policies and governance, which are crucial for maintaining security. It would be a beneficial asset for customers who have AWS in their infrastructure. I would rate it nine out of ten.

We've been using it for a considerable period. We had a large enterprise with multiple teams and projects, and we employed AWS Tower to streamline the setup and management of multiple AWS accounts, each with its own predefined guidelines and configurations. This was particularly beneficial for our organization, which has strict security and compliance requirements. AWS Tower played a crucial role in enforcing best practices and policies across these AWS accounts, ensuring they were provisioned with the necessary security controls and configurations. This approach significantly reduced the chances of misconfigurations and unauthorized access.

Additionally, we utilized AWS Control Tower to facilitate the creation of new AWS accounts for various projects, teams, and departments. We leveraged the account factory feature to automate the provisioning of new accounts, including defined variables and configurations. This automation considerably reduced the time and effort required to set up a new account.

In my capacity as a DevOps engineer, I've had the opportunity to utilize AWS Tower to enhance our organization's management of AWS infrastructure at an enterprise level. It has played a crucial role in achieving consistent governance and security standards across our multiple AWS accounts. I took the lead on a project aimed at centralizing and optimizing AWS account management to cater to various departments and projects while ensuring stringent security and compliance. AWS Tower served as the cornerstone of this initiative.

During the implementation phase, I began by configuring a landing zone using AWS Control Tower. This landing zone incorporated best practices in networking, security controls, and identity management. I then customized it to align with our organization's specific security requirements, effectively establishing a secure foundation for all our AWS accounts.

The most significant benefit of Control Tower is its capability to align with our organization's standards. The primary advantage is the consistency it brings to governance, allowing us to enforce security policies and automate account provisioning. It plays a crucial role in ensuring security and compliance, which is a top priority for our company. Additionally, it simplifies management and aids in cost control. It offers customization and flexibility, as well as scalability to support our organization's growth.           

There's room for improvement in several security aspects. While AWS Tower provides predefined guardrails for enforcing security and compliance, offering more customizable options would be beneficial. Allowing organizations to define custom guardrails or modify existing ones to align with specific security and compliance requirements would enhance flexibility.

Integration with popular third-party DevOps and security tools could streamline workflows. Moreover, introducing more advanced governance policies would enable organizations to define and enforce complex policies effectively. Improving support for multi-region configurations is essential, along with simplifying ongoing management, such as enhancing the AWS Control Tower custom dashboard.

Advanced notifications and alerts, including integration with popular incident management tools, would be valuable additions. Lastly, establishing a robust feedback mechanism and actively engaging with the user community could provide valuable insights for further improvement.

I have worked with AWS Control Tower for about six years.

I would rate the stability a six out of ten. 

I would rate the scalability a seven out of ten.

The initial setup is complex.

It is expensive but it is an investment.

To make effective use of AWS, organizations should start by assessing their AWS usage and being transparent about their pricing requirements. They need to understand the specific needs of their organization and evaluate whether the AWS Control Tower features align with those needs. It's important to thoroughly research the available capabilities of AWS Tower and determine if it can provide the necessary support. Customization should be considered to tailor the solution to their unique requirements. Organizations should also assess their integration needs, explore automation opportunities for improved efficiency, and review their multi-account strategy. Scalability and future readiness should be factored in when making decisions. Additionally, they should closely examine the pricing structure and consider engaging with AWS support. They can collect valuable feedback from peers which can help in the decision-making process.

I would rate the overall product a nine out of ten.

When the company was facing certain downtime and latency in their AWS accounts, and they wanted to integrate multiple AWS accounts to improve flexibility and performance, I suggested using AWS Control Tower to set up a well-architected multi-account environment. It is used to effectively manage multiple accounts, including one dedicated to data residency compliance, which is crucial, especially for email operations.

It aligns well with the customer's needs and it ultimately fosters a strong customer-company relationship.

The way they currently handle security logs and company-wide logging could be improved as centralizing these systems would make it much easier to trace any security breaches. Without proper tracking of API logs and timely resolution of errors, the company could face significant financial losses. By making APIs and organizational units more centralized, it would be simpler to pinpoint the source of issues in case of a breach and would ultimately benefit everyone involved.

I find it to be extremely stable, and I would rate it a nine out of ten. AWS Control Tower also offers comprehensive documentation regarding the regions where it can operate effectively, which contributes to its reliability.

I would rate its scalability capabilities eight out of ten.

I have used numerous solutions such as AWS CloudFormation, IAM, Terraform, and their various components to create a wide range of projects in the cloud environment.

It is notably user-friendly because it provides default values and guidance. For instance, when setting up the two organizations, they offer predefined names for the sandbox and security accounts. When inputting names for the audit and log accounts, they also provide explanations. This user-friendly approach makes it accessible even for someone with no prior AWS experience. It's quite intuitive, especially with the provided guidance.

The deployment process depends on the resources being utilized and the scale of the deployment. If you aim to implement governance across multiple regions, it can be time-consuming because provisioning resources in each of those regions may require additional time and effort.

I have been able to assist clients in determining cost-effective solutions based on their specific needs. The pay-as-you-go model ensures you're only charged for what you use, which offers great flexibility for different types of companies.

Without the correct setup, users may encounter errors and mishaps with AWS Control Tower. To avoid these issues, I would recommend ensuring they establish an AWS organization correctly, configure services accordingly, and enable the appropriate policies that align with AWS best practices. Overall, it is an excellent product. I would rate it a nine out of ten considering all the factors.

We use the product to streamline AWS account management. 

AWS Control Tower helps companies save costs. 

I like the tool's customization and configuration. 

AWS Control Tower should improve its fast execution. It also needs more tools for triggering and monitoring AWS services. AWS Control Tower needs more tracking as well. 

I have been working with the solution for four to five years. 

I rate the product's stability an eight out of ten. 

I rate AWS Control Tower's scalability an eight out of ten. 

The tool's deployment was not easy in the beginning. However, it got better with practice. Deployment is easy now. 

AWS Control Tower helped us save money. 

You need to know about AWS and the cloud before using the product. I rate it a seven out of ten. 

We use AWS Control Tower to manage multiple accounts. It provides a central point for account management, access control, and compliance monitoring.

There could be more features for security and automation in the product.

We have been using AWS Control Tower for three years.

I rate the product's stability a seven out of ten. It gets subjected to malware attacks regardless of fundamental security features. We need to ensure it stays compliant.

It allows for centralized management of multiple AWS accounts and a layer of control and security to the organization's environment. The scalability depends on the organization and how effectively you implement and utilize the service. I rate its scalability an eight out of ten.

The initial setup process is simple as AWS already configures most things. The deployment time depends on the process and the complexity of the environment.

The product's affordability depends on the value it brings to specific organizations. Small businesses may find it expensive. It helps streamline operations, improve security, and reduce costs by enforcing best practices and policies. Thus, it is costly but valuable.

I rate AWS Control Tower an eight out of ten.

At the moment, I can't comment on the features of the tool since it is not a necessary tool. However, it is a good tool to manage and centralize, especially for managing the servers and certain features on the cloud. Even though there are solutions that offer functionalities similar to AWS Control Tower, I don't know how to use any of them.

While using the solution recently, it broke a certain activity. So, AWS Control Tower needs to consider making the solution better.

I have experience with AWS Control Tower.

I know how to use it, and I am comfortable with AWS Control Tower. Scalability-wise, I rate it a seven out of ten.

I rate the technical support an eight out of ten.

Positive

The solution's initial setup was easy for me.

In Brazil, pricing for AWS Control Tower is very, very high. On a scale of one to ten, where one is a low price and ten is a high price, I rate the pricing an eight.

I think AWS Control Tower is a good solution, and I am comfortable understanding its functionalities. At the moment, I do not use stack-up solutions in any of my operations in a day, but I understand the channel that they help you to apply applications for the use of customers. I rate the overall product a five out of ten.

We use the solution to provide a specific configuration. The rule of AWS Control Tower is to make sure that we're creating the accounts in a specific way in AWS.

AWS Control Tower helps us to make sure that all the accounts that we're creating now follow a specific configuration. We are sure that all the accounts always configure the same.

Compliance is the most valuable feature. The feature helps us ensure that all the accounts are compliant with the requirements of the company.

The integration with other AWS functions has room for improvement. I would like the ability to integrate other options or functions into the organization.

The initial setup is a bit complex and has room for improvement.

I have been using the solution for one and a half years.

I give the stability a ten out of ten.

I give the scalability a ten out of ten.

The initial setup is a bit complex.

We have seen a return on investment. It can be costly for an organization to make sure they meet all the compliances and AWS Control Tower helps us be compliant which minimizes the cost.

The solution is free.

I give the solution a seven out of ten.

People should not rely on AWS Control Tower alone because it is a portion of the configuration but it's not everything.