AWS Control Tower Reviews & Product Details

I like that everything is centralized and service control policies can be implemented quickly. Review collected by and hosted on G2.com.

Decommisioning landing zones can sometimes be challenging. Review collected by and hosted on G2.com.

Can create and manage all subaccounts as one place. Customer support is good. Review collected by and hosted on G2.com.

Cannot use the same business support level to all sub accounts. Review collected by and hosted on G2.com.

We moved most of the on prem to cloud AWS, using control tower it helped us to anlyze requirement and upscale capacity accordingly no more waiting on vendors for deliverables Review collected by and hosted on G2.com.

I cannot think of any at the moment of course it's pricey, Review collected by and hosted on G2.com.

View policy-level summaries of your AWS environment. Automate ongoing policy management. Quickly setup and configure a new AWS environment. Review collected by and hosted on G2.com.

It limit of 5 SCPs per OU applies to OUs. Existing OUs with over 300 accounts cannot be registered or re-registered in AWS Control Tower. Review collected by and hosted on G2.com.

Works well with very few faults or problems Review collected by and hosted on G2.com.

Not as simple to access at others we've used. Review collected by and hosted on G2.com.

It's straightforward to automate existing products like Config, Landing Zone, and Organizations. Control Tower generates various IAM roles and CloudFormation stack sets to facilitate automation. However, I've encountered occasional errors with these scripts.

Setting up a new account is very simple. You can create a new account with just a button click or using the CLI. Review collected by and hosted on G2.com.

Removing new accounts is hard for newbies. Things randomly fail at times. Review collected by and hosted on G2.com.

One of the most resourceful accessories for all creators out there. Review collected by and hosted on G2.com.

Not much. I dislike not using it earlier in the game Review collected by and hosted on G2.com.

It helps in multiple account management on a single platform for a defined number of users. Review collected by and hosted on G2.com.

Pricing for features that are not in usability for time Review collected by and hosted on G2.com.

The only positive thing I can say about Control Tower is that does offer the protections it mentions on the box. However there are many ways to skin a cat, and the way they've chosen to do it is a unique kind of torture. Review collected by and hosted on G2.com.

Everything about the implementation.

Migration of existing accounts is a painstaking process whereby the instructions basically tell you to "increase your SSO timeout to 12 hours, set up a workstation with Python/Boto3 and run this python script to import an account. Each account takes around 30 minutes, so do it in batches of around 24 accounts and hope it doesn't time out... if it does, just re-run it again... but you can only do that after you've manually logged into accounts and performed prerequisite tasks first- oh, and that nested Organisational Unit structure you had setup previously? Forget about it, Control Tower can only handle a flat structure- we obviously didn't have enough time to implement inheritance".

Did you want to change more than one thing? "I'm sorry that last change you made is still being applied by CloudFormation, that will take several minutes to complete. Please come back when you've lost all context of what you were trying to do". If you want to assign a Guardrail to 2-3 OU's you need to budget at least 20-30 minutes for no other reason that Control Tower tells you that its busy and you can't do anything until the previous CloudFormation operation has completed.

Oh, did I mention CloudFormation? Control Tower loves to clutter up your accounts with new IAM roles and CloudFormation stacks/stacksets. Given that a large chunk of the guard rails involve protecting the guard rails themselves, and the remainders are things like "prevent public access checkbox from being ticked on RDS instances", "limit the number of VPCs that can be created"- why they couldn't implement these things in some backend infrastructure outside of your application/environment account is beyond me.

All in all it feels like a proof of concept more than it does a finished product. Review collected by and hosted on G2.com.

AWS Control Tower automates the setup of the baseline environment or landing zone for a well-architected multi-account environment. It enhances security and protection when two accounts are used for a single purpose, preventing data theft and safeguarding account information. As enterprises migrate to AWS, they often have numerous applications and distributed teams. Control Tower automates the setup of the customer's landing zone and configures AWS management and security services based on established best practices in a secure, compliant, multi-account environment. Distributed teams can quickly provision AWS accounts. The most crucial feature is the visual summaries of the AWS environment, which simplify the process of finding account details. It offers a dashboard that continuously displays the AWS environment. Review collected by and hosted on G2.com.

There are no drawbacks, but it is costly, and the user documentation for this software is a bit complex to understand. Review collected by and hosted on G2.com.