Scaling compliance with AWS Control Tower
summary
Control Tower deploys a multi-account landing zone with a log-archive and audit account, Identity Center, an account vending factory and 400 managed controls that map to frameworks; detective checks use AWS Config and Security Hub, preventive controls use Service Control Policies, and CloudFormation Guard proactive hooks block noncompliant provisioning. Custom rules use the Rule Development Kit + Lambda; Audit Manager collects signed, encrypted evidence. AWS shows 27–52% audit cost reduction at 25% automation and ~1–2% saved per control implemented.
AI-written summary · about
chapters (12)
- 0:00Introduction to GRC 301
- 1:37Assessing compliance maturity
- 7:20The future of cloud compliance
- 10:34AWS Control Tower for compliance
- 14:30Continuous automation strategies
- 18:32Business outcomes of automation
- 22:11Control Tower architecture
- 26:50Deploying proactive controls
- 31:53Data residency and encryption
- 38:36Control Tower demo
- 48:32Putting actions into practice
- 52:37Audit management and conclusion
related talks
21mSecuring hundreds of AWS accounts for streamlined governance
40mCreating a managed, governed, and secure SaaS foundation on
28mSecure cloud migration environments built with Control Tower &
32mCreate a cloud-ready environment
28mStay in Control While Moving Fast
47mManage AWS Cloud Environments Easily and Securely
41mBuild cloud foundations for growth and resilience
49mCloud operations: A catalyst for innovation