AWS Control Tower Reviews

I'm using the solution for account security and governance.

I've used AWS Control Tower as an additional account security and governance layer. This client reached out to us because they had security problems in their accounts, and they wanted us to assist them with some security strategies. I started by helping them build a solid foundation where their accounts could be managed. When I talk about managing accounts, they could use AWS organization and Control Tower as an additional layer for security best practices. This means I would build a management account to enable the AWS organization to create different organizational units, which will act as a container for managing the AWS accounts with the organization's customers. With AWS Control Tower, I could build a landing zone for account best practices, which means implementing guardrails in AWS Control Tower. There are 24 guardrails. We have preventive and detective guardrails. Preventive guardrails use an SAP policy, which limits identities from performing certain actions within the AWS accounts. Apart from that, I was also able to make detective guardrails, which help to detect certain abnormalities or certain activities being done by identities within that environment. And these activities may make our environments non-compliant. It sends alerts to us so we can revoke anything done in that account.

There are two features in Control Tower which are the most valuable. One is the guardrails because it has preventive and detective guardrails. I also like SSO, which is single sign-on, because single sign-on helps in our AWS organization. And with guardrails, it helps to limit identities from performing certain actions in that AWS account.

I think AWS Control Tower can improve on its guardrails and the SAP policies. These are policies that help to prevent users from performing certain actions in an AWS account in that AWS organization. Security is important, and AWS Control Tower is used mostly for security. The solution's stability could be improved as well.

I have five years of experience with AWS Control Tower.

I rate AWS Control Tower's stability a five out of ten.

I give AWS Control Tower's scalability an eight out of ten.

The initial setup was straightforward.

AWS Control Tower is not really that expensive.

Control Tower is an additional layer of security providing multi-account governance and compliance, which is an additional layer of security in an AWS organization. Every company would like to have a 90% or 100% secure environment. I advise companies to choose AWS Control Tower because it has that additional layer of security on AWS accounts. We have preventive and detective guardrails. It prevents things from happening in that organization, and when things happen, it can detect who did what when in an AWS organization. The detective guardrails give you everything: the time, the person, and everything done. You can easily trace who did what in an AWS account.

I rate AWS Control Tower an eight out of ten.

AWS Control Tower helps to save a lot of work and manage multiple accounts. 

The tool's setup is very technical. Its pricing can be cheaper. 

I have been working with the product for three years. 

AWS Control Tower's stability is excellent. 

The product is very scalable. My company has two users for the product. 

I rate AWS Control Tower a ten out of ten since it is easy and automated. 

When we took on that project, the client had various business units within their organization, including a BI unit, an engineering unit, and other units related to development and different business functions. They also had a centralized IT team responsible for cloud operations. Initially, their AWS environment was highly decentralized, lacking a centralized management system. They approached us to establish a centralized solution that could handle tasks like creating new AWS accounts based on business needs and enforcing baseline security standards. To address their requirements, we engaged with AWS and, after discussing their needs, concluded that migrating to AWS Control Tower would be the most suitable solution. In addition to Control Tower, we set up a centralized networking system to provide controlled access to new accounts. This approach centralized authentication and access management, simplifying operations. We also implemented various guardrails, as their previous setup lacked mechanisms for account owners to identify and adhere to best practices. After implementation, we organized the AWS organization structure based on their business units, each with its set of preventive and detective guardrails. This allowed for a more structured and controlled environment.

When we compare it to the earlier approach of setting up from scratch, the solution proved to be highly valuable. With Control Tower, there are ready-to-use automated templates available, simplifying the implementation of a centralized management solution. We have approximately three hundred managed AWS rules that are common to Control Tower, which is a significant advantage. This means we no longer have to write complex Python code, as it is all managed for us. When we need to provision a new AWS account or establish specific guardrails and baselines, Control Tower offers an excellent option. Previously, if we had to create a new account, we had to set up the foundational networking components manually, including writing templates for VPCs, subnets, and more. With Control Tower, it became remarkably easy to configure these baseline networking components for a new AWS account.

It is undoubtedly a growing service, and it's evident that AWS is continuously working to improve it. However, some challenges do arise when it comes to migrating existing accounts that are not yet under Control Tower into the system. This process often involves creating specific roles manually, and it can be somewhat tedious and there isn't a readily available set of guidelines for this process. It requires some searching and digging through to find the necessary information. It is essential to clarify that this isn't necessarily a drawback of the service, but having a clear and concise set of predefined guidelines from AWS for moving existing accounts under AWS Control Tower would be highly beneficial as it would simplify the process and make it more user-friendly. 

We used it for a couple of months.

When setting up from scratch, stability isn't usually a major concern as you're starting with a clean slate. The real challenges arise when you have existing accounts that aren't integrated with Control Tower. Achieving stability in such cases can be a bit of a struggle, as it often involves navigating complex configurations and adjustments to align those accounts with Control Tower's framework. I would rate it seven out of ten.

During our discussions, we learned that AWS Control Tower initially allows you to launch it in a single region for each account. This limitation posed a challenge because it doesn't inherently provide high availability across multiple regions. When we inquired with AWS, they confirmed that at the time, they primarily operate within a single region, even though you can manage multiple regions within that account. While this setup can be highly available within that single region, it presents some complexities when aiming for broader geographical coverage. It does offer scalability, and it can manage a substantial number of accounts. To the best of my knowledge, it supports up to around two hundred to two hundred fifty accounts. I would rate it eight out of ten.

We didn't encounter significant issues, especially since the authentication was handled by us, as a partner.

We were previously using AWS landing zone, and managing it was relatively straightforward. There was a significant amount of configuration required. We had to set up the AWS organization separately, and there were various aspects to manage under different categories. Control Tower simplifies the management of these interconnected components, making it more efficient and user-friendly.

The initial setup was straightforward. I began using it for the first time last year, and I found it to be an easy and user-friendly tool.

It took approximately one to one and a half hours to set up the basic configuration, while the entire project spanned about six months. This extended timeline was due to various additional tasks we needed to address. We had to centralize networking, establish a centralized firewall, manage ingress and egress controls, and handle a range of other requirements.

I would say it is average. It operates on a pay-as-you-go model, meaning we are charged only for the services we actively use within it.

It is a highly commendable product. It significantly enhances the management of multi-account architectures. It stands out as one of the best products AWS has introduced in recent years. I'm confident that AWS will continue to make enhancements, possibly expanding support to additional regions and introducing more managed rules to seamlessly align with evolving business needs. I would rate it eight out of ten.

We have two types of customers: those who are new to AWS and are onboarding for the first time, and those who are already using AWS but have not opted for Control Tower. The second group is now implementing virtual data to enhance policy governance and create landing zones. 

It is noted that policies created manually based on administrator or security recommendations may lack consideration for other parameters. Control Tower aims to address these concerns and offer optimal features, including database and policies, to assist customers in implementing policy-driven governance extensively within their organization.

It offers automated recommendations for security and policies, creating a landing zone and providing a list of policies. Customers can also add their policies and access helpful templates.

It could be improved by having a more intuitive graphical interface. It could also include other coding languages like PowerShell and Python, as it would be beneficial for DevOps recommendations. Having the capability to create architectural designs in a diagram format while creating the landing zone would help showcase the design to higher-level stakeholders.

I have over five years of experience with AWS Control Tower implementation.

It offers great stability.

It is scalable and can be easily customized based on specific requirements. If the number of workloads increases in the future, the landing zone can expand to accommodate the additional workload.

I also use Microsoft Azure, which has its cloud framework and can be implemented alongside AWS. It is easier to use and offers better due diligence, but AWS has a greater number of resources and services available. Choosing between the two platforms depends on factors such as application load, design, and pricing.

The initial setup was quite easy.8

Once AWS Control Tower is enabled, it automatically creates the landing zone and presents policies for the customers to review and agree upon. The implementation process is intuitive, automated, and can be managed by one or two people. The time required for implementation varies, but for small organizations, it typically takes half an hour. When it's implemented, it does not require regular maintenance unless further customizations are needed for infrastructure.

There is a noticeable benefit from implementing AWS, as we heard from various customers. While the cost may be higher compared to on-premise data centers, the services and facilities provided by AWS greatly contribute to the success and value of the businesses. 

The cost is reasonable, but there are opportunities for improvement in terms of pricing for larger enterprises. As organizations accumulate costs for numerous services, it can become a significant amount so reducing these costs would be beneficial.

I highly recommend AWS Control Tower as it is a valuable tool for both first-time and long-term AWS adopters. It helps to manage policies and governance, which are crucial for maintaining security. It would be a beneficial asset for customers who have AWS in their infrastructure. I would rate it nine out of ten.

We've been using it for a considerable period. We had a large enterprise with multiple teams and projects, and we employed AWS Tower to streamline the setup and management of multiple AWS accounts, each with its own predefined guidelines and configurations. This was particularly beneficial for our organization, which has strict security and compliance requirements. AWS Tower played a crucial role in enforcing best practices and policies across these AWS accounts, ensuring they were provisioned with the necessary security controls and configurations. This approach significantly reduced the chances of misconfigurations and unauthorized access.

Additionally, we utilized AWS Control Tower to facilitate the creation of new AWS accounts for various projects, teams, and departments. We leveraged the account factory feature to automate the provisioning of new accounts, including defined variables and configurations. This automation considerably reduced the time and effort required to set up a new account.

In my capacity as a DevOps engineer, I've had the opportunity to utilize AWS Tower to enhance our organization's management of AWS infrastructure at an enterprise level. It has played a crucial role in achieving consistent governance and security standards across our multiple AWS accounts. I took the lead on a project aimed at centralizing and optimizing AWS account management to cater to various departments and projects while ensuring stringent security and compliance. AWS Tower served as the cornerstone of this initiative.

During the implementation phase, I began by configuring a landing zone using AWS Control Tower. This landing zone incorporated best practices in networking, security controls, and identity management. I then customized it to align with our organization's specific security requirements, effectively establishing a secure foundation for all our AWS accounts.

The most significant benefit of Control Tower is its capability to align with our organization's standards. The primary advantage is the consistency it brings to governance, allowing us to enforce security policies and automate account provisioning. It plays a crucial role in ensuring security and compliance, which is a top priority for our company. Additionally, it simplifies management and aids in cost control. It offers customization and flexibility, as well as scalability to support our organization's growth.           

There's room for improvement in several security aspects. While AWS Tower provides predefined guardrails for enforcing security and compliance, offering more customizable options would be beneficial. Allowing organizations to define custom guardrails or modify existing ones to align with specific security and compliance requirements would enhance flexibility.

Integration with popular third-party DevOps and security tools could streamline workflows. Moreover, introducing more advanced governance policies would enable organizations to define and enforce complex policies effectively. Improving support for multi-region configurations is essential, along with simplifying ongoing management, such as enhancing the AWS Control Tower custom dashboard.

Advanced notifications and alerts, including integration with popular incident management tools, would be valuable additions. Lastly, establishing a robust feedback mechanism and actively engaging with the user community could provide valuable insights for further improvement.

I have worked with AWS Control Tower for about six years.

I would rate the stability a six out of ten. 

I would rate the scalability a seven out of ten.

The initial setup is complex.

It is expensive but it is an investment.

To make effective use of AWS, organizations should start by assessing their AWS usage and being transparent about their pricing requirements. They need to understand the specific needs of their organization and evaluate whether the AWS Control Tower features align with those needs. It's important to thoroughly research the available capabilities of AWS Tower and determine if it can provide the necessary support. Customization should be considered to tailor the solution to their unique requirements. Organizations should also assess their integration needs, explore automation opportunities for improved efficiency, and review their multi-account strategy. Scalability and future readiness should be factored in when making decisions. Additionally, they should closely examine the pricing structure and consider engaging with AWS support. They can collect valuable feedback from peers which can help in the decision-making process.

I would rate the overall product a nine out of ten.

We use the product to streamline AWS account management. 

AWS Control Tower helps companies save costs. 

I like the tool's customization and configuration. 

AWS Control Tower should improve its fast execution. It also needs more tools for triggering and monitoring AWS services. AWS Control Tower needs more tracking as well. 

I have been working with the solution for four to five years. 

I rate the product's stability an eight out of ten. 

I rate AWS Control Tower's scalability an eight out of ten. 

The tool's deployment was not easy in the beginning. However, it got better with practice. Deployment is easy now. 

AWS Control Tower helped us save money. 

You need to know about AWS and the cloud before using the product. I rate it a seven out of ten. 

We use AWS Control Tower to manage multiple accounts. It provides a central point for account management, access control, and compliance monitoring.

There could be more features for security and automation in the product.

We have been using AWS Control Tower for three years.

I rate the product's stability a seven out of ten. It gets subjected to malware attacks regardless of fundamental security features. We need to ensure it stays compliant.

It allows for centralized management of multiple AWS accounts and a layer of control and security to the organization's environment. The scalability depends on the organization and how effectively you implement and utilize the service. I rate its scalability an eight out of ten.

The initial setup process is simple as AWS already configures most things. The deployment time depends on the process and the complexity of the environment.

The product's affordability depends on the value it brings to specific organizations. Small businesses may find it expensive. It helps streamline operations, improve security, and reduce costs by enforcing best practices and policies. Thus, it is costly but valuable.

I rate AWS Control Tower an eight out of ten.

At the moment, I can't comment on the features of the tool since it is not a necessary tool. However, it is a good tool to manage and centralize, especially for managing the servers and certain features on the cloud. Even though there are solutions that offer functionalities similar to AWS Control Tower, I don't know how to use any of them.

While using the solution recently, it broke a certain activity. So, AWS Control Tower needs to consider making the solution better.

I have experience with AWS Control Tower.

I know how to use it, and I am comfortable with AWS Control Tower. Scalability-wise, I rate it a seven out of ten.

I rate the technical support an eight out of ten.

Positive

The solution's initial setup was easy for me.

In Brazil, pricing for AWS Control Tower is very, very high. On a scale of one to ten, where one is a low price and ten is a high price, I rate the pricing an eight.

I think AWS Control Tower is a good solution, and I am comfortable understanding its functionalities. At the moment, I do not use stack-up solutions in any of my operations in a day, but I understand the channel that they help you to apply applications for the use of customers. I rate the overall product a five out of ten.

We use the solution to provide a specific configuration. The rule of AWS Control Tower is to make sure that we're creating the accounts in a specific way in AWS.

AWS Control Tower helps us to make sure that all the accounts that we're creating now follow a specific configuration. We are sure that all the accounts always configure the same.

Compliance is the most valuable feature. The feature helps us ensure that all the accounts are compliant with the requirements of the company.

The integration with other AWS functions has room for improvement. I would like the ability to integrate other options or functions into the organization.

The initial setup is a bit complex and has room for improvement.

I have been using the solution for one and a half years.

I give the stability a ten out of ten.

I give the scalability a ten out of ten.

The initial setup is a bit complex.

We have seen a return on investment. It can be costly for an organization to make sure they meet all the compliances and AWS Control Tower helps us be compliant which minimizes the cost.

The solution is free.

I give the solution a seven out of ten.

People should not rely on AWS Control Tower alone because it is a portion of the configuration but it's not everything.