-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathcontroltower.html
More file actions
471 lines (447 loc) · 25.1 KB
/
controltower.html
File metadata and controls
471 lines (447 loc) · 25.1 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>AWS Control Tower Security | AWS Security Cards</title>
<meta name="description" content="AWS Control Tower orchestrates multi-account governance by deploying a landing zone with guardrails, Account Factory, and centralized logging.">
<style>
*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
body {
font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', sans-serif;
background: #0a0e1a;
color: #e2e8f0;
line-height: 1.6;
padding: 2rem;
max-width: 1200px;
margin: 0 auto;
}
a { color: #22d3ee; text-decoration: none; }
a:hover { text-decoration: underline; }
/* Card Image */
.card-image {
border-radius: 1rem;
overflow: hidden;
margin-bottom: 2rem;
border: 1px solid rgba(255,255,255,0.1);
}
.card-image img {
width: 100%;
height: auto;
display: block;
}
/* Header */
.header {
position: relative;
overflow: hidden;
border-radius: 1rem;
background: linear-gradient(135deg, #06b6d415, #0a0e1a, #0ea5e915);
border: 1px solid #06b6d44d;
padding: 2.5rem;
margin-bottom: 2rem;
}
.header::before {
content: '';
position: absolute;
top: 0; right: 0;
width: 24rem; height: 24rem;
background: #06b6d40d;
border-radius: 50%;
filter: blur(3rem);
}
.header-content { position: relative; display: flex; align-items: flex-start; gap: 1.5rem; }
.header-icon { width: 64px; height: 64px; flex-shrink: 0; }
.header-icon img { width: 100%; height: 100%; }
.header-title { font-size: 1.875rem; font-weight: 700; color: #fff; }
.header-badge {
display: inline-block;
padding: 0.25rem 0.75rem;
background: #06b6d433;
color: #06b6d4;
font-size: 0.8rem;
font-weight: 600;
border-radius: 999px;
border: 1px solid #06b6d44d;
margin-left: 0.75rem;
vertical-align: middle;
}
.header-desc { color: #94a3b8; max-width: 42rem; margin-top: 0.5rem; }
/* Stats */
.stats-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 1rem; margin-bottom: 2rem; }
.stat-card {
background: rgba(255,255,255,0.03);
border-radius: 0.5rem;
border: 1px solid rgba(255,255,255,0.06);
padding: 1rem;
text-align: center;
}
.stat-value { font-size: 1.5rem; font-weight: 700; }
.stat-label { font-size: 0.8rem; color: #94a3b8; }
/* Sections */
.section {
background: rgba(255,255,255,0.03);
border-radius: 0.75rem;
border: 1px solid rgba(255,255,255,0.06);
padding: 1.5rem;
margin-bottom: 1.5rem;
}
.section h2 {
font-size: 1.25rem;
font-weight: 700;
color: #fff;
margin-bottom: 1rem;
display: flex;
align-items: center;
gap: 0.5rem;
}
/* Overview */
.overview-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 1.5rem; }
.overview-grid h4 { font-size: 0.9rem; font-weight: 600; margin-bottom: 0.5rem; }
.overview-grid p { font-size: 0.875rem; color: #94a3b8; margin-bottom: 0.75rem; }
.attack-note {
background: rgba(0,0,0,0.3);
border-radius: 0.5rem;
border: 1px solid rgba(255,255,255,0.06);
padding: 0.75rem;
font-size: 0.875rem;
color: #cbd5e1;
}
/* Risk Gauge */
.risk-gauge { display: flex; align-items: center; gap: 2rem; }
.risk-bar-container { flex: 1; }
.risk-bar {
height: 1rem;
background: #0f172a;
border-radius: 999px;
overflow: hidden;
}
.risk-bar-fill {
height: 100%;
border-radius: 999px;
background: linear-gradient(90deg, #eab308, #f97316, #ef4444);
}
.risk-labels { display: flex; justify-content: space-between; font-size: 0.8rem; color: #94a3b8; margin-top: 0.5rem; }
.risk-score { text-align: center; }
.risk-score-value { font-size: 2.5rem; font-weight: 700; color: #f87171; }
.risk-score-label { font-size: 0.8rem; color: #94a3b8; }
.risk-desc { margin-top: 1rem; font-size: 0.875rem; color: #94a3b8; }
/* Panels Grid */
.panels-grid { display: grid; grid-template-columns: repeat(3, 1fr); gap: 1.5rem; margin-bottom: 1.5rem; }
@media (max-width: 1024px) { .panels-grid { grid-template-columns: repeat(2, 1fr); } }
@media (max-width: 640px) { .panels-grid, .stats-row, .overview-grid { grid-template-columns: 1fr; } }
.panel {
background: rgba(255,255,255,0.03);
border-radius: 0.75rem;
border: 1px solid;
padding: 1.5rem;
}
.panel h3 { font-size: 1.1rem; font-weight: 700; margin-bottom: 1rem; display: flex; align-items: center; gap: 0.5rem; }
.panel h4 { font-size: 0.85rem; font-weight: 600; margin-bottom: 0.5rem; margin-top: 1rem; }
.panel ul { list-style: none; padding: 0; }
.panel li {
font-size: 0.85rem;
color: #cbd5e1;
padding: 0.15rem 0;
display: flex;
align-items: flex-start;
gap: 0.5rem;
}
.bullet { margin-top: 0.15rem; }
.note {
margin-top: 1rem;
padding: 0.75rem;
border-radius: 0.5rem;
font-size: 0.85rem;
}
/* Commands */
.cmd-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 1rem; }
.cmd-block { margin-top: 0.75rem; }
.cmd-title { font-size: 0.8rem; color: #94a3b8; margin-bottom: 0.25rem; }
pre {
background: rgba(0,0,0,0.5);
border-radius: 0.5rem;
padding: 0.75rem;
font-size: 0.8rem;
color: #4ade80;
overflow-x: auto;
border: 1px solid rgba(255,255,255,0.06);
white-space: pre-wrap;
word-break: break-all;
font-family: 'SF Mono', 'Fira Code', 'Cascadia Code', monospace;
}
/* Policies */
.policy-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 1.5rem; }
.policy-card {
border-radius: 0.5rem;
border: 1px solid;
padding: 1rem;
}
.policy-header { display: flex; align-items: center; gap: 0.5rem; margin-bottom: 0.75rem; font-size: 0.9rem; }
.policy-card pre { margin-bottom: 0.75rem; color: #cbd5e1; }
.policy-desc { font-size: 0.8rem; color: #94a3b8; }
/* Defenses */
.defense-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 1rem; }
.defense-card {
background: rgba(255,255,255,0.03);
border-radius: 0.5rem;
border: 1px solid rgba(255,255,255,0.06);
padding: 1rem;
}
.defense-card:hover { border-color: #22d3ee4d; }
.defense-header { display: flex; align-items: flex-start; gap: 0.75rem; }
.defense-icon { font-size: 1.5rem; }
.defense-card h4 { font-size: 0.9rem; font-weight: 600; color: #fff; margin-bottom: 0.25rem; }
.defense-card p { font-size: 0.85rem; color: #94a3b8; margin-bottom: 0.5rem; }
.defense-card pre { color: #22d3ee; }
/* Footer */
.footer { text-align: center; padding: 1.5rem 0; font-size: 0.8rem; color: #64748b; }
.footer a { color: #22d3ee; }
/* Prevent ugly page-break splits */
.card-image,
.header,
.stat-card,
.stats-row,
.section,
.panel,
.cmd-block,
.policy-card,
.defense-card,
.attack-note,
.overview-grid > div,
.risk-gauge,
.note {
break-inside: avoid;
page-break-inside: avoid;
}
.section,
.panels-grid,
.card-image,
.header {
break-before: auto;
page-break-before: auto;
}
/* Keep headings with their content */
h2, h3, h4 {
break-after: avoid;
page-break-after: avoid;
}
@media print {
body { background: #0a0e1a; -webkit-print-color-adjust: exact; print-color-adjust: exact; }
.panels-grid { grid-template-columns: repeat(2, 1fr); }
.cmd-grid { grid-template-columns: 1fr; }
.policy-grid { grid-template-columns: 1fr; }
.defense-grid { grid-template-columns: 1fr; }
}
</style>
</head>
<body>
<!-- Card Image -->
<div class="card-image">
<img src="../images/controltower-card.webp" alt="AWS Control Tower Security" />
</div>
<!-- Header -->
<div class="header">
<div class="header-content">
<div class="header-icon"><img src="../icons/controltower.svg" alt="AWS Control Tower Security" /></div>
<div>
<div>
<span class="header-title">AWS Control Tower Security</span>
<span class="header-badge">MANAGEMENT</span>
</div>
<p class="header-desc">AWS Control Tower orchestrates multi-account governance by deploying a landing zone with guardrails (preventive, detective, proactive), Account Factory, and centralized logging. Compromising the management account or disabling controls grants unrestricted access across the entire organization.</p>
</div>
</div>
</div>
<!-- Stats -->
<div class="stats-row">
<div class="stat-card">
<div class="stat-value" style="color: #f87171;">CRITICAL</div>
<div class="stat-label">Risk Level</div>
</div>
<div class="stat-card">
<div class="stat-value" style="color: #4ade80;">Prev/Det/Pro</div>
<div class="stat-label">Control Types</div>
</div>
<div class="stat-card">
<div class="stat-value" style="color: #60a5fa;">Landing Zone</div>
<div class="stat-label">Governance</div>
</div>
<div class="stat-card">
<div class="stat-value" style="color: #c084fc;">Mgmt Account</div>
<div class="stat-label">Top Target</div>
</div></div>
<!-- Overview -->
<div class="section"><h2><span style="color:#06b6d4;">📋</span> Service Overview</h2><div class="overview-grid">
<div>
<h4 style="color: #06b6d4;">Landing Zone & Controls</h4>
<p>Pre-configured secure multi-account environment. Preventive controls (SCPs), detective controls (Config rules), and proactive controls (CloudFormation Hooks). Mandatory controls cannot be disabled.</p>
<div class="attack-note"><span style="color:#06b6d4;">Attack note:</span> The management account is exempt from all preventive controls (SCPs). Any identity in this account can bypass every guardrail.</div>
</div>
<div>
<h4 style="color: #06b6d4;">Account Factory & Key Roles</h4>
<p>Standardized account provisioning via Service Catalog. Creates AWSControlTowerExecution role in every member account with AdministratorAccess, trusting the management account root.</p>
<div class="attack-note"><span style="color:#06b6d4;">Attack note:</span> AWSControlTowerExecution in every member account has AdministratorAccess and trusts the management account root with no conditions by default.</div>
</div></div></div>
<!-- Risk Assessment -->
<div class="section">
<h2>Security Risk Assessment</h2>
<div class="risk-gauge">
<div class="risk-bar-container">
<div class="risk-bar">
<div class="risk-bar-fill" style="width: 95%;"></div>
</div>
<div class="risk-labels"><span>Low</span><span>Medium</span><span>High</span><span>Critical</span></div>
</div>
<div class="risk-score">
<div class="risk-score-value">9.5</div>
<div class="risk-score-label">Risk Score</div>
</div>
</div>
<p class="risk-desc">Compromise of the management account means full admin access to every enrolled member account via AWSControlTowerExecution. Disabling controls removes guardrails organization-wide. Drift introduced by an attacker can disable security detection without obvious alerts.</p>
</div>
<!-- Main Panels -->
<div class="panels-grid">
<div class="panel" style="border-color: #f8717133;">
<h3 style="color: #f87171;">⚔️ Attack Vectors</h3><h4 style="color: #f87171;">Management Account Compromise</h4><ul><li><span class="bullet" style="color: #f87171;">•</span> Assume AWSControlTowerExecution in any member account</li><li><span class="bullet" style="color: #f87171;">•</span> Exploit weakly-scoped IAM policies for role assumption</li><li><span class="bullet" style="color: #f87171;">•</span> Compromise AWSControlTowerAdmin role</li><li><span class="bullet" style="color: #f87171;">•</span> Target Account Factory / AFT pipeline credentials</li><li><span class="bullet" style="color: #f87171;">•</span> Social-engineer org administrators</li></ul><h4 style="color: #f87171;">Control & Landing Zone Manipulation</h4><ul><li><span class="bullet" style="color: #f87171;">•</span> Disable preventive controls (SCPs) on OUs</li><li><span class="bullet" style="color: #f87171;">•</span> Disable detective controls to stop compliance monitoring</li><li><span class="bullet" style="color: #f87171;">•</span> Introduce landing zone drift by modifying SCPs</li><li><span class="bullet" style="color: #f87171;">•</span> Delete/modify AWSControlTowerCloudTrailRole</li><li><span class="bullet" style="color: #f87171;">•</span> Abuse delegated administrator privileges</li></ul></div>
<div class="panel" style="border-color: #fb923c33;">
<h3 style="color: #fb923c;">⚠️ Misconfigurations</h3><h4 style="color: #fb923c;">Dangerous Defaults</h4><ul><li><span class="bullet" style="color: #fb923c;">•</span> AWSControlTowerExecution trusts mgmt account root with no conditions</li><li><span class="bullet" style="color: #fb923c;">•</span> No Permissions Boundaries on management account identities</li><li><span class="bullet" style="color: #fb923c;">•</span> Only mandatory controls enabled</li><li><span class="bullet" style="color: #fb923c;">•</span> Account Factory provisions without additional SCPs</li><li><span class="bullet" style="color: #fb923c;">•</span> Audit account Lambda roles have cross-account admin</li></ul><h4 style="color: #fb923c;">Governance Gaps</h4><ul><li><span class="bullet" style="color: #fb923c;">•</span> No alerting for control disable/enable operations</li><li><span class="bullet" style="color: #fb923c;">•</span> Landing zone drift not monitored</li><li><span class="bullet" style="color: #fb923c;">•</span> AFT pipeline credentials stored without rotation</li><li><span class="bullet" style="color: #fb923c;">•</span> No SCP protecting Control Tower roles in member accounts</li><li><span class="bullet" style="color: #fb923c;">•</span> Management account used for daily workloads</li></ul></div>
<div class="panel" style="border-color: #22d3ee33;">
<h3 style="color: #22d3ee;">🔍 Enumeration</h3><div class="cmd-block">
<div class="cmd-title">List Landing Zones</div>
<pre><code>aws controltower list-landing-zones</code></pre>
</div><div class="cmd-block">
<div class="cmd-title">List Enabled Controls on an OU</div>
<pre><code>aws controltower list-enabled-controls \
--target-identifier arn:aws:organizations::123456789012:ou/o-abc/ou-abc-xyz</code></pre>
</div><div class="cmd-block">
<div class="cmd-title">List Drifted Controls</div>
<pre><code>aws controltower list-enabled-controls \
--target-identifier OU_ARN \
--filter '{"driftStatuses":["DRIFTED"]}'</code></pre>
</div><div class="cmd-block">
<div class="cmd-title">List All Baselines</div>
<pre><code>aws controltower list-baselines</code></pre>
</div><div class="cmd-block">
<div class="cmd-title">List Organization Accounts</div>
<pre><code>aws organizations list-accounts \
--query 'Accounts[*].[Id,Name,Status]' --output table</code></pre>
</div></div>
<div class="panel" style="border-color: #c084fc33;">
<h3 style="color: #c084fc;">📈 Privilege Escalation</h3><h4 style="color: #c084fc;">From Member to Full Org Access</h4><ul><li><span class="bullet" style="color: #c084fc;">•</span> Assume AWSControlTowerExecution in any member account</li><li><span class="bullet" style="color: #c084fc;">•</span> Audit account role chain to AdministratorExecutionRole</li><li><span class="bullet" style="color: #c084fc;">•</span> Register compromised account as delegated admin</li><li><span class="bullet" style="color: #c084fc;">•</span> Exploit management account identity with sts:AssumeRole *</li></ul><h4 style="color: #c084fc;">From Management Account</h4><ul><li><span class="bullet" style="color: #c084fc;">•</span> Disable preventive controls to remove SCP restrictions</li><li><span class="bullet" style="color: #c084fc;">•</span> Disable detective controls to blind compliance</li><li><span class="bullet" style="color: #c084fc;">•</span> Modify landing zone manifest to weaken security</li><li><span class="bullet" style="color: #c084fc;">•</span> Create new accounts with attacker-controlled settings</li></ul><div class="note"><strong>Key insight:</strong> AWSControlTowerExecution has AdministratorAccess in every member account. A single sts:AssumeRole with Resource: * in the management account is enough to pivot to all accounts.</div></div>
<div class="panel" style="border-color: #facc1533;">
<h3 style="color: #facc15;">🔗 Persistence</h3><h4 style="color: #facc15;">Maintaining Access</h4><ul><li><span class="bullet" style="color: #facc15;">•</span> AWSControlTowerExecution role persists across account lifecycle</li><li><span class="bullet" style="color: #facc15;">•</span> Add conditions bypass in member account trust policies</li><li><span class="bullet" style="color: #facc15;">•</span> Create accounts via Account Factory with backdoor settings</li><li><span class="bullet" style="color: #facc15;">•</span> Register as delegated administrator for sensitive services</li><li><span class="bullet" style="color: #facc15;">•</span> Store AFT pipeline credentials for future access</li></ul><h4 style="color: #facc15;">Evading Detection</h4><ul><li><span class="bullet" style="color: #facc15;">•</span> Introduce drift that disables detective controls</li><li><span class="bullet" style="color: #facc15;">•</span> Modify CloudTrail role to disrupt centralized logging</li><li><span class="bullet" style="color: #facc15;">•</span> Move accounts between OUs to bypass controls</li><li><span class="bullet" style="color: #facc15;">•</span> Disable auto-enrollment for new accounts</li><li><span class="bullet" style="color: #facc15;">•</span> Use management account (exempt from SCPs)</li></ul></div>
<div class="panel" style="border-color: #4ade8033;">
<h3 style="color: #4ade80;">🛡️ Detection</h3><h4 style="color: #4ade80;">Critical CloudTrail Events</h4><ul><li><span class="bullet" style="color: #4ade80;">•</span> DisableControl / EnableControl - control changes</li><li><span class="bullet" style="color: #4ade80;">•</span> UpdateLandingZone / ResetLandingZone - LZ modifications</li><li><span class="bullet" style="color: #4ade80;">•</span> AssumeRole on AWSControlTowerExecution</li><li><span class="bullet" style="color: #4ade80;">•</span> CreateManagedAccount - new account creation</li><li><span class="bullet" style="color: #4ade80;">•</span> DisableBaseline - baseline removal</li></ul><h4 style="color: #4ade80;">Drift Indicators</h4><ul><li><span class="bullet" style="color: #4ade80;">•</span> SCP modifications outside Control Tower</li><li><span class="bullet" style="color: #4ade80;">•</span> Accounts moved between OUs manually</li><li><span class="bullet" style="color: #4ade80;">•</span> Control Tower roles modified in member accounts</li><li><span class="bullet" style="color: #4ade80;">•</span> Landing zone status showing DRIFTED</li><li><span class="bullet" style="color: #4ade80;">•</span> CloudTrail configuration changes</li></ul></div></div>
<!-- Exploitation -->
<div class="section"><h2><span style="color:#f87171;">💻</span> Exploitation Commands</h2><div class="cmd-grid"><div class="cmd-block">
<div class="cmd-title">Assume AWSControlTowerExecution</div>
<pre><code>aws sts assume-role \
--role-arn arn:aws:iam::MEMBER_ACCOUNT_ID:role/AWSControlTowerExecution \
--role-session-name ct-pivot</code></pre>
</div><div class="cmd-block">
<div class="cmd-title">Disable a Control on an OU</div>
<pre><code>aws controltower disable-control \
--control-identifier arn:aws:controltower:us-east-1::control/CONTROL_ID \
--target-identifier OU_ARN</code></pre>
</div><div class="cmd-block">
<div class="cmd-title">List SCPs on an OU</div>
<pre><code>aws organizations list-policies-for-target \
--target-id ou-xxxx-xxxxxxxx \
--filter SERVICE_CONTROL_POLICY</code></pre>
</div><div class="cmd-block">
<div class="cmd-title">Get Landing Zone Drift Status</div>
<pre><code>aws controltower get-landing-zone \
--landing-zone-identifier LZ_ARN</code></pre>
</div></div></div>
<!-- Policies -->
<div class="section"><h2><span style="color:#4ade80;">📜</span> Policy Examples</h2><div class="policy-grid"><div class="policy-card" style="border-color: #ef444433; background: rgba(239,68,68,0.05);">
<div class="policy-header">
<span style="color: #f87171; font-size: 1.2em;">✗</span>
<span style="color: #f87171; font-weight: 600;">Dangerous - Wildcard AssumeRole in Mgmt Account</span>
</div>
<pre><code>{
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "*"
}</code></pre>
<p class="policy-desc">Allows assumption of AWSControlTowerExecution in every member account -- full org compromise</p>
</div><div class="policy-card" style="border-color: #22c55e33; background: rgba(34,197,94,0.05);">
<div class="policy-header">
<span style="color: #4ade80; font-size: 1.2em;">✓</span>
<span style="color: #4ade80; font-weight: 600;">Secure - Permissions Boundary Blocking CT Role</span>
</div>
<pre><code>{
"Effect": "Deny",
"Action": "sts:AssumeRole",
"Resource": "arn:aws:iam::*:role/AWSControlTowerExecution"
}</code></pre>
<p class="policy-desc">Applied as Permissions Boundary to block unauthorized pivoting to member accounts</p>
</div><div class="policy-card" style="border-color: #22c55e33; background: rgba(34,197,94,0.05);">
<div class="policy-header">
<span style="color: #4ade80; font-size: 1.2em;">✓</span>
<span style="color: #4ade80; font-weight: 600;">Secure - SCP Protecting CT Roles</span>
</div>
<pre><code>{
"Effect": "Deny",
"Action": ["iam:DeleteRole", "iam:PutRolePolicy", "iam:UpdateAssumeRolePolicy"],
"Resource": ["arn:aws:iam::*:role/AWSControlTowerExecution", "arn:aws:iam::*:role/aws-controltower-*"]
}</code></pre>
<p class="policy-desc">Prevents member account identities from modifying or deleting Control Tower roles</p>
</div></div></div>
<!-- Defenses -->
<div class="section"><h2><span style="color:#4ade80;">🛡️</span> Defense Recommendations</h2><div class="defense-grid"><div class="defense-card">
<div class="defense-header">
<span class="defense-icon">🏢</span>
<div>
<h4>Isolate the Management Account</h4>
<p>Run zero production workloads. Restrict to Control Tower administration, Organizations management, and billing only.</p>
</div>
</div>
</div><div class="defense-card">
<div class="defense-header">
<span class="defense-icon">🛡️</span>
<div>
<h4>Apply Permissions Boundaries</h4>
<p>Deny sts:AssumeRole against AWSControlTowerExecution on all management account identities.</p>
</div>
</div>
</div><div class="defense-card">
<div class="defense-header">
<span class="defense-icon">🔒</span>
<div>
<h4>Add Conditions to CT Execution Trust</h4>
<p>Modify trust policy on AWSControlTowerExecution in member accounts to require principal tags or IP ranges.</p>
</div>
</div>
</div><div class="defense-card">
<div class="defense-header">
<span class="defense-icon">✅</span>
<div>
<h4>Enable All Strongly Recommended Controls</h4>
<p>Do not rely only on mandatory controls. Enable all strongly recommended preventive and detective controls.</p>
</div>
</div>
</div><div class="defense-card">
<div class="defense-header">
<span class="defense-icon">🔔</span>
<div>
<h4>Monitor Control Tower API Calls</h4>
<p>Alert on DisableControl, EnableControl, UpdateLandingZone, and AWSControlTowerExecution role assumptions.</p>
</div>
</div>
</div><div class="defense-card">
<div class="defense-header">
<span class="defense-icon">🚫</span>
<div>
<h4>Protect CT Roles via SCP</h4>
<p>Deploy SCP denying modification/deletion of AWSControlTowerExecution and aws-controltower-* roles by member accounts.</p>
</div>
</div>
</div></div></div>
<!-- Footer -->
<div class="footer">
<p>AWS Control Tower Security Security Card</p>
<p style="margin-top:0.25rem;">Always obtain proper authorization before testing</p>
</div>
</body>
</html>