AWS Control Tower Reviews

My primary use case for AWS Control Tower is multi-account governance, as it provides a standardized landing zone that allows us to provision accounts consistently, enforce security guardrails, centralize logging, and maintain compliance across the AWS organization.

A recent example involved onboarding new AWS accounts for development and non-production workloads; instead of manually configuring IAM, logging, security services, networking standards, and compliance controls, we provisioned the accounts through AWS Control Tower's Account Factory, and the new accounts automatically inherited the governance controls, logging configurations, and the security baselines.

The best features AWS Control Tower offers are automated landing zone deployment, Account Factory for standardized account provisioning, preventive and detective guardrails, integration with AWS Organizations, centralized logging and audit capabilities, well-built-in security governance, a dashboard for compliance monitoring, and multi-account management at scale.

AWS Control Tower has positively impacted my organization by improving our governance, accelerating our account provisioning, reducing configuration inconsistencies and manual processes, and strengthening our security posture. It has enabled us to scale cloud adoption while maintaining centralized oversight and compliance.

I would like to see greater customization and flexibility for the landing zone, easier integration with existing enterprise environments, more advanced reporting and governance dashboards, and expanded regional support.

I have been using AWS Control Tower for approximately five to six years in an enterprise AWS environment, using it to establish and govern AWS accounts and landing zones, particularly in a regulated financial services organization where security, compliance, and standardization are critical.

AWS Control Tower significantly reduced the time required to onboard new AWS accounts, as what previously could take days of manual configuration can now be completed in a matter of hours with a standardized setup. It has reduced governance-related operational effort by ensuring security controls are applied consistently across AWS accounts.

I rely on the guardrails because they help enforce security and compliance standards without requiring extensive custom development.

AWS Control Tower provides tremendous value by simplifying multi-account governance and reducing operational complexity. The reason I do not give it a 10 is that larger enterprises sometimes require more flexibility and customization than the service currently provides.

While AWS Control Tower is not primarily an AI-driven service, its governance and security capabilities are among its strongest features, as the combination of guardrails, centralized governance, AWS Organizations integration, and automated compliance monitoring helps AWS organizations establish a secure foundation for AWS adoption.

I find AWS Control Tower's governance and compliance output highly reliable, as the service accurately reports guardrail compliance status, account enrollment status, and governance posture, providing trustworthy information for operational and audit purposes.

You should start with a clear account strategy, as the design architecture for your organization must be clear. Different organizational units, security requirements, logging strategy, and account lifecycle processes should be clear upfront. AWS Control Tower delivers the most value when implemented as the foundation of a well-planned multi-account architecture. I would also recommend adopting AWS Control Tower early in your cloud journey because it is easier to establish governance from the beginning rather than to try to retrofit governance into a large existing environment later.

I rate this solution nine out of ten.

I use AWS Control Tower to enhance governance, enhance security, and manage multiple subsidiaries. We sunset the AWS Control Tower that I implemented, but it was a new project that we implemented. It is good for some use cases and not suitable for others, especially when I built the common blockchain infrastructure for the whole CP group in Thailand which has multiple organizations and subsidiaries. When it scaled down, the project needed to run at a very small scale. AWS Control Tower is too complex for a small team, but for big projects with multiple BUs and one single team to manage them, AWS Control Tower can be suitable.

The advantages of AWS Control Tower that stand out for me include centralized management and easy governance control. We can implement policy as code.

My experience with the automated security guardrails in AWS Control Tower shows it has a built-in mechanism on the security control policy. In the past, we would create the policy on paper and in an Excel sheet. Now we need to create a JSON format that can be kept and stored on a Git repository for the blueprint, making it easier for tracking changes.

I leverage Account Factory customization options in AWS Control Tower; it is a useful feature, but it enforces you to use it if you use AWS Control Tower. It is useful because if you create the template for the account, when you provision it, it can be simpler to scale or provision the new account. For example, if you have a security team for company A and create the account template, then if you have another company, you can use the Account Factory to create and provision it. The centralized logging and monitoring functionalities in AWS Control Tower are useful, but I did not use them much at that time. We implemented it and provisioned it, and later on, we were just monitoring. It has some hidden costs or we do not know how to manage it appropriately.

I believe AWS Control Tower could be improved. I compare it with Huawei Cloud's enterprise project, which is a similar concept but different implementation. In Huawei Cloud, you partition in one single account, but in AWS, you have to separate many accounts. You end up with maybe 20 or 30 accounts if you try to separate. It has limitations; you pay a fixed amount for 15 accounts, but if you exceed that, you have to pay more. It could be useful for implementing a Cloud Center of Excellence (CCOE) for multiple organizations, but for one organization, I would advise against it; it is too much overhead and adds hidden costs.

There are limitations on the Landing Zone feature as well. If we implement AWS Control Tower, we need to implement Landing Zone and the security policy, guardrails, and Account Factory; it is not one single product. Using another cloud's enterprise project, you can just create the project and manage it already. It requires some learning curve to get hands-on.

For pricing and licensing of AWS Control Tower, it has hidden costs. The Control Tower itself does not cost much, but the child accounts created from AWS Control Tower add costs for checking all configurations, logging, and metrics.

I have been working with AWS Control Tower for around three to four years.

The installation of AWS Control Tower is challenging at the beginning. However, after you have done it once, it becomes clear that it is not that difficult. You can follow through the guideline, but there are many processes. At that time, there were many manual processes, scripting to create it, and YAML files to develop.

I do not see any issues about stability; there are no glitches or latency issues.

The solution is scalable enough; it just has limitations in terms of commercial pricing. They add soft limits on the product.

My experience with technical support from AWS is satisfactory. It depends on each project. If we go for premium support, they have a technical account manager and treat you very well, but for the developer plan support, it is just adequate. Some issues take two to three months to resolve, while others can resolve in just one or two days. I would rate it around eight.

Positive

Regarding CyberArk, I am not really touching the product; I just see it all the time, but I used 1Password. That solution I used is not from Delinea; it is from 1password.com. Before it was for personal use, but now it has stepped into software development. It integrates with Kubernetes and command line and is developer-friendly.

I see 1Password Business, but the team plan is sufficient on my side for the new small team. I try to create a corporate startup and use it for the new project.

AWS Control Tower creates many issues from the operation point of view and requires the engineer to get a better understanding. It takes time, and it can become a blocker because our engineers do not understand it enough. It requires a learning curve to use it. After that, AWS Control Tower can integrate with the AWS service because it is suitable for the AWS environment. There is the product to learn, and AWS has documentation, but I think it needs some kind of demo on it, an interactive demo—not only the text. There is a lot of text that engineers need to read and understand. It would be better to have an interactive demo or a sandbox environment to play.

For ROI, I do not see it yet. At that time, it felt excessive because when we create a new project, it should be something small and go to market fast, or an MVP product. We originally wanted every organization in the big group to use this, but in real execution, we only had a pilot for one organization, which made it feel useless. If we have a clear direction on the group company wanting to implement a CCOE, then this should be the way.

Only AWS has AWS Control Tower; the other clouds have their own products. The Landing Zone is a concept that every cloud can implement, but Control Tower is the product name of AWS.

I am Head of Platform Engineering at Ascentcorp. Hybrid and multi-cloud is how I have it set up. We have multiple projects, and it depends on what kind of requirement. On cloud is around 60 to 70%, and 30 to 40% is on-premises. I have it on AWS cloud and also on Huawei Cloud. I buy some products from AWS Marketplace directly, but not much. Currently, I mostly use our own deployment, self-managed. I used the product from AWS, and we use AWS extensively. We are the number one customer in Thailand that uses AWS. We use many AWS services including EKS, RDS, S3, and the network services Transit Gateway, Landing Zone, Control Tower, MSK, EMR and EBS. The Landing Zone capability is useful but has some limitations. It has hidden costs and operational overhead on managing the Landing Zone security. If everything is fully implemented, it is good for the long term and for large organizations; it helps with fine-grained cost tracking on each unit. I rate AWS Control Tower a seven out of ten.

I use Control Tower with my AWS organization whenever I want to sync the security part with the integration and manage those parts via AWS Control Tower. I primarily use it for security purposes and to manage the security of child accounts within my AWS organization.

Control Tower offers many valuable features for managing all account security. I can manage user security and user IAM, firewall, and other security-related tasks via Control Tower. The unified security management is a crucial aspect, and whenever an AWS organization is used, Control Tower is typically included to ensure comprehensive compliance fulfillment.

There is a sync issue within the organization. It is important that the system syncs automatically instead of requiring me to manually choose sync options.

I have used the solution for three years.

I rate the stability ten out of ten. 

It is a stable solution managed by AWS, which ensures that I find the products stable as well.

I rate the scalability ten out of ten. It is beneficial because it is totally managed by AWS, meaning I do not have to worry about scalability or durability.

I have not used customer support specifically for Control Tower, yet, given the quality of AWS services, I believe their support for this product is also good.

Neutral

I rate the initial setup eight out of ten. Although minor tricky aspects exist, such as choosing the organization and control towers needed for multiple accounts, the process overall is relatively simple.

Control Tower within the AWS Organization does not have a charge. It is free and does not incur additional charges.

In terms of advice for new users, I suggest focusing on your AWS goal and the compliance you need to achieve. 

Once you understand your compliance requirements, you can sync the rules with Control Tower to ensure everything is in line with your needs.

I would rate the solution a 10 out of 10.

We utilized AWS Control Tower for implementing guardrails, mainly for account creation and enforcing rules related to security, application access, and other relevant aspects. The tool ensures that CI/CD pipelines, incorporating TerraForm codes, are only accepted if they adhere to the predefined guardrails established by the company.

With Control Tower, there's no need to worry about individuals creating accounts and introducing risks to the company. Control Tower ensures that everything created in the organization is regulated. People are compelled to adhere to established rules. The key is to ensure that these rules are practical. If, for instance, you restrict internet access, it means no one in the organization can access the internet. Therefore, it's essential to carefully define rules, specifying the required IP addresses, interfaces, and security protocols to achieve the desired regulation within AWS.

The most intriguing feature is the automatic generation of user accounts. Leveraging Active Directory and global company settings, AWS Control Tower enables the creation of AWS user accounts based on job descriptions in Active Directory. This establishes a direct correlation between the user's name, job definition, and the corresponding rules applied to each account.

There aren't any additional features that I feel are missing. However, it's worth noting that Control Tower seems to function as a layer utilizing standard AWS products in the background. Occasionally, the interface may appear less streamlined, with changes in layout based on the underlying products being used. While this doesn't impact functionality, having a more standardized user interface, irrespective of the background products, could enhance the user experience.

I have been using AWS Control Tower for one year.

The stability of AWS Control Tower is satisfactory. It's a reliable product that builds upon existing AWS services, providing a user-friendly interface to streamline various tasks. The product is well-established and stable, offering a comprehensive solution that ensures all relevant aspects of a task are addressed, preventing oversights that may occur when performed manually.

The scalability of AWS Control Tower is commendable. When you use this product, you automatically gain additional resources from AWS, and this scalability feature is provided without incurring extra charges. For instance, the automatic user creation or account creation function may have a minimal cost, like a few cents per user per year, making it an almost free-of-charge feature.

Positive

We utilize AWS products for security, firewall, and networking settings. However, when managing manual processes within AWS, coordination among different departments, such as network and security, can become challenging. Control Tower becomes invaluable in this context, compelling us to establish a comprehensive plan rather than individualized setups. This ensures a global approach to AWS implementation, reducing the risks associated with inconsistent data access and unauthorized permissions.

The user interface is generally straightforward, but it involves a combination of different products in the background. One complexity arises when interfacing with Active Directory, especially when bridging AWS and Azure. AWS makes assumptions, while Azure's Active Directory can be highly customized. In many cases, companies have diverse Active Directory setups due to mergers, making it challenging to connect AWS to Azure seamlessly. Improvement could be made in handling the variety of Active Directory configurations, considering that companies often have a mix of settings rather than a single standardized setup. Activating Control Tower is straightforward, and it should be done before creating AWS accounts. In an existing AWS implementation, activating Control Tower can be impactful, as previous builds might lack control over guardrails and security settings implemented in Control Tower. This could lead to disruptions in working environments, and it is recommended to either create Control Tower at the beginning of a project or set it up alongside existing environments. Verifying that everything works before transitioning to production is crucial to avoid the high risk of disruptions in the production environment.

We handled the deployment in-house without the need for external consultants or integrators. By default, all users entering the company are automatically connected to Control Tower. Regarding the technical team for deployment and maintenance, we had an architect each for security, networking, and AWS cloud, along with one manager and one engineer for implementation—so, in total, five people.

I believe it's free of charge or comes at a very low cost. It's an additional feature. Even if there is a fee, it's minimal. AWS seems to assist customers in gaining a comprehensive view of their security setups within AWS. Using Control Tower is highly recommended, especially as your company grows and involves Active Directory, various departments, and different architectural aspects. It becomes more advisable to leverage Control Tower rather than managing these aspects manually, especially for larger organizations.

Overall, I rate the solution a nine out of ten. 

It enables companies, entities, and teams to elevate their innovation levels, as it consistently introduces new services, both on a quarterly and annual basis, each brimming with features that catalyze innovation for these entities.

Reliability is the standout factor. Its approach to architecting infrastructure is geared towards unparalleled reliability. It is incredibly user-friendly and functions seamlessly.

The sole drawback is its restriction to enable only one Control Tower. This limitation hinders its effectiveness, particularly for organizations or management accounts with multiple subsidiaries that require more than one.

I have been working with it for three years.

It is a highly reliable product. We never faced any issues or setbacks in the performance.

It offers good scalability capabilities.

There are instances where the wait times can exceed expectations, and reaching a specialist, particularly at the higher tiers like level two and level three support, may sometimes require more time than desired. However, it's important to emphasize that even with these considerations, AWS support stands out as the best option when compared to support services offered by other cloud providers. On a scale of one to ten, I would rate it at a solid nine.

Positive

The initial setup was easy.

It is cost-effective and the associated cost is quite minimal. The only investment is the time and effort required to acquire the skills necessary to use it.

It serves as a valuable tool to streamline governance, ensure compliance across these accounts, and facilitate the establishment of standardized practices in areas like security, monitoring, and logging, which are often referred to as cross-cutting concerns. I would strongly recommend using Control Tower if you have multiple AWS accounts. Overall, I would rate it eight out of ten.

It stands out as a valuable service due to its extensive capabilities, including predefined, detective, and preventive guardrails. It eliminates the need to scour a catalog for services, making tasks like creating custom Amazon Machine Images (AMIs) straightforward for developers. It streamlines the process of setting up and managing management accounts within my organization due to its well-structured integration of various services and functionalities.

I currently oversee data management within our organization, which includes the administration of various data accounts. This involves the ability to seamlessly switch between different accounts to ensure efficient management, which is particularly useful for managing a diverse set of accounts created to serve various purposes within our organization. The robust security features provided by AWS Control Tower play a crucial role in ensuring the integrity and protection of our data.

One noteworthy aspect of AWS Config and Service Control Policies (SCPs) is the effectiveness of SCPs in defining and enforcing restrictions within the AWS environment. When SCPs are applied, they serve as preventive measures by limiting certain actions and behaviors within the environment. Instead of merely granting a user a broad set of privileges, SCPs allow for a more fine-grained approach. You can specify which AWS services a user is permitted to access, aligning permissions precisely with the daily tasks they need to perform. This level of control ensures that access is tailored to the specific requirements of the user's role and responsibilities.

When it comes to security in the ever-evolving AWS landscape, it's a constant challenge because Amazon keeps introducing new features and services regularly. I would suggest improvement regarding the ongoing pursuit of enhanced security within the Control Tower environment. This means continuously refining and fortifying the service to ensure that it meets the stringent security requirements of both large, established organizations and those newcomers venturing into the cloud for the first time. It would be beneficial if AWS offered the capability to seamlessly deploy your infrastructure to another region to ensure continuous availability and redundancy.

I have been working with it for four years.

I would rate its stability capabilities quite highly, perhaps a nine out of ten. While it's an excellent service overall, there have been instances where certain services experienced temporary disruptions due to factors like regional availability.

Scalability remains a key priority, as it caters to the diverse needs of AWS users, regardless of their organization's size or level of cloud adoption. I would rate it ten out of ten.

The customer support has been consistently excellent. I would rate it ten out of ten.

Positive

When establishing your landing zone, you start by creating your accounts, including Organizational Units (OUs) and Core accounts. After that, you simply organize your accounts according to your needs within the OUs and manage them accordingly. This streamlined approach makes the initial setup of Control Tower quite user-friendly and efficient.

The ROI is undeniably excellent. It offers significant value by simplifying the management of multiple AWS accounts effectively. Moreover, from a security perspective, it empowers you to organize your accounts within the organization and implement preventive guardrails using Service Control Policies (SCPs) and AWS Config. These preventive measures and detection mechanisms play a crucial role in safeguarding your organization against attacks and ensuring you have visibility into the activities occurring within your environment.

The pricing structure is closely intertwined with the specifics of your environment and the billing strategy you employ. One notable feature that plays a significant role in pricing is AWS Hub, which offers consolidated billing, so instead of each individual account in your organization being billed separately, you can group them together and it typically results in reduced pricing.

I would strongly recommend AWS Control Tower, especially for companies with large, complex organizations or enterprises. This service is particularly beneficial when dealing with various organizational units within your company as it allows for efficient structuring and categorizing of these units and places the associated accounts accordingly. One of the standout advantages is the fine-grained control it offers in terms of permissions and privileges. You can tailor access to specific AWS resources based on the job functions and responsibilities of users or accounts. From a security perspective, it excels in providing robust controls and access management. I would rate it ten out of ten.

We use the solution for internal purposes. It is essential for managing a multi-account environment. It simplifies the management of multiple accounts by providing automated account provisioning, centralized policy enforcement, and governance, which is beneficial for complex environments.

AWS Control Tower is a tool specifically designed for multi-account management. It offers the advantage of highly granular management. 

AWS should provide more resources, examples, and tutorials. Mastering the technology will be more wonderful, but it takes some time to moderate.

I have been using AWS Control Tower as a reseller for a year.

Stability is essential. AWS helped us to deploy a new environment.

I rate the solution’s stability a ten out of ten.

I rate the solution’s scalability a six out of ten.

The initial setup is moderately complex. It requires a deep understanding of AWS account management. It's not intended for beginners but for individuals with advanced knowledge.

It took about two weeks and three people to complete.

I rate the initial setup a five out of ten, where one is difficult and ten is easy.

The advantage of the Control Tower is that you can totally reshape your environment and have more unified policies and content.

The product is very affordable.

I rate the product’s pricing as two out of ten, where one is cheap, and ten is expensive.

We use it based on automation. We can create new customers or entities and automatically apply specific configurations according to predefined rules. This automation is a key feature of Control Tower. Additionally, Control Tower can be scripted to automate these processes further.

Although not directly related, the combination of AWS Management and Control Tower simplifies accounts' management and billing structure. One notable advantage is the separation between account structure management and account billing. For instance, it allows us to use a centralized billing system and centralized account management, which is highly beneficial.

It has become very central and essential. Without Control Tower, for instance, we couldn't automate the creation of thousands of environments across the company, but with it, we can.

You need to be a good AWS architect. It requires more skill than just being a practitioner. Ideally, you should be an architect and have an AWS Certification.

Overall, I rate the solution a nine out of ten.

When the company was facing certain downtime and latency in their AWS accounts, and they wanted to integrate multiple AWS accounts to improve flexibility and performance, I suggested using AWS Control Tower to set up a well-architected multi-account environment. It is used to effectively manage multiple accounts, including one dedicated to data residency compliance, which is crucial, especially for email operations.

It aligns well with the customer's needs and it ultimately fosters a strong customer-company relationship.

The way they currently handle security logs and company-wide logging could be improved as centralizing these systems would make it much easier to trace any security breaches. Without proper tracking of API logs and timely resolution of errors, the company could face significant financial losses. By making APIs and organizational units more centralized, it would be simpler to pinpoint the source of issues in case of a breach and would ultimately benefit everyone involved.

I find it to be extremely stable, and I would rate it a nine out of ten. AWS Control Tower also offers comprehensive documentation regarding the regions where it can operate effectively, which contributes to its reliability.

I would rate its scalability capabilities eight out of ten.

I have used numerous solutions such as AWS CloudFormation, IAM, Terraform, and their various components to create a wide range of projects in the cloud environment.

It is notably user-friendly because it provides default values and guidance. For instance, when setting up the two organizations, they offer predefined names for the sandbox and security accounts. When inputting names for the audit and log accounts, they also provide explanations. This user-friendly approach makes it accessible even for someone with no prior AWS experience. It's quite intuitive, especially with the provided guidance.

The deployment process depends on the resources being utilized and the scale of the deployment. If you aim to implement governance across multiple regions, it can be time-consuming because provisioning resources in each of those regions may require additional time and effort.

I have been able to assist clients in determining cost-effective solutions based on their specific needs. The pay-as-you-go model ensures you're only charged for what you use, which offers great flexibility for different types of companies.

Without the correct setup, users may encounter errors and mishaps with AWS Control Tower. To avoid these issues, I would recommend ensuring they establish an AWS organization correctly, configure services accordingly, and enable the appropriate policies that align with AWS best practices. Overall, it is an excellent product. I would rate it a nine out of ten considering all the factors.

The last client I used Control Tool for was moving from on-premises to cloud, moving from a foundational environment to building on top of what the resources would rely on. Control Tower was one of the tools we used because it was good at building or integrating landing zones. The main reason for the shift was to keep the environment compliant and secure. The window would show LAN connections with speed and how large it was. We had to set up a landing zone in this environment, and the landing zone came with a management account. This management account was with other accounts like AWS Organization and single sign-on.

Control Tower helped make the environment stay compliant and secure. It worked with the AWS backend to improve the organization by managing multiple accounts in the entire structure.

Security is the most valuable feature of Control Tower.

You don't do anything when you set up these landing zones, such as the AWS Organization single sign-on. Everything is preconfigured, and you just have to do automation. Everything is established in the environment. If Control Tower could do this, it would be much better where all the security tools are already in it. I know AWS has its security tools, like Security Hub and Cloud Check, with minimal configuration. It would be much better if you set up the landing zone, which is the master account in the foundation of the environment, and all these tools are included. You should just get to go in and go, "Okay, I need this at this particular time." You should get to go in and do it. There should be more automation security tools in the Control Tower.

I've used Control Tower for three or four years, and I'm using the latest version.

I rate Control Tower's stability an eight out of ten.

I rate Control Tower's scalability an eight out of ten.

The initial setup was straightforward because a lot of automation goes on. You just have to show someone two or three things, and they can go ahead and do it. Especially setting up landing zones. You can show them what you know, what they have to do, and what they want to do with the organization simultaneously. When setting up these landing zones, they all have to be linked to a single sign-on. You need to integrate that and extend approval to other active directories like Okta because that's not automatic. You have to do that yourself. But the basic features are easy to set up because a lot of automation goes on.

The price depends on what you want to do. For example, if you want EC2, choose micro or whatever. If you choose EC2, maybe it has to run for 24 hours, but that would be different from someone who has to run the tool for two hours or one hour. With my personal AWS account, I sometimes leave it running without knowing.

Before choosing Control Tower, you must know what you want to do. I've noticed that most people who use it leave on-premises to go to the cloud. You shouldn't be in the cloud before thinking of using Control Tower. If you move into the cloud, you need the foundation to start something. You need somewhere to run your resources. When migrating into the cloud, you have to go for Control Tower. It will provide the best practices when setting up a landing zone. All the other solutions, like Account Factory and all of that, start from the foundation. People who have been in the industry for many years want cloud control. AWS Organization and single sign-on come automatically with Control Tower, but you can still create AWS Organization and single sign-on out of Control Tower. You need to know what you want to do with Control Tower. You need to know what to do with the solution's security capabilities.

I rate AWS Control Tower a nine out of ten.

It is an efficient solution for managing multiple AWS accounts and ensuring the correct structure and settings are in place. It allows for the creation of different organizational units and the application of various security policies and use cases. It provides centralized solutions for all AWS accounts in one place, customized to meet the organization's specific needs. It is a mandatory tool for those who work with multiple AWS accounts and want to effectively manage their cloud strategy.

It offers various valuable features. One of them is centralized authentication, allowing for single sign-on across all AWS accounts. Another feature is Guardrails, which are security policies applied to each organizational unit, ensuring appropriate permission levels. The service catalog is another strong feature, enabling the provision of centralized solutions to specific organization units. Control Tower also facilitates the management and sharing of automation pieces. Overall, it provides all the necessary tools for effectively managing multiple AWS accounts.

Previously, AWS Organizations was responsible for managing accounts in AWS, but with the introduction of AWS Control Tower, these services became incompatible. This creates challenges as changes made in one service may not be visible in the other. The process of closing an AWS account using Control Tower needs improvements to simplify it, especially when managing multiple accounts. AWS Control Tower should also include additional solutions like a centralized scheduler to automate compute schedules and other maintenance and structure planning actions, enhancing the overall user experience.

We have been using it for a few years since its initial release. We experienced initial challenges and issues with the service but have observed improvements over time.

It is generally stable, although there may be occasional instances where certain features or details do not work as expected. It is considered the correct and reliable way to manage multiple AWS accounts. The service is regularly updated by AWS, indicating a commitment to its stability and improvement. While there is room for improvement, it is still regarded as a stable service.

It has a limitation that only one account can be provisioned at a time, which may seem restrictive, but it doesn't have a significant impact on the overall work as it is a centralized task that is not done frequently. The ability to increase capacity and functionality aligns well with most user's needs. It is not a service that is used on-demand, but rather it becomes an integral part of the overall architecture and structure. Once implemented, it serves as the framework and foundation for the entire production environment and it is consistently used in the daily operations of the organization.

The support level is highly satisfactory. AWS provides a good knowledge base and experience for end-users. In our case, we utilize enterprise support, which ensures quick and professional responses to our queries. I would rate it eight out of ten.

Positive

We used AWS Organizations, but we switched to AWS Control Tower as it provides a more enriched set of services to effectively handle network security, governance, and centralized challenges across multiple accounts. The decision to adopt AWS Control Tower was a correct choice for improved account management.

Our team has developed an automated solution that utilizes AWS Control Tower to create new AWS accounts tailored to our specific security requirements and organizational needs. We have automated the process of provisioning service quota and deploying our application using its features. This end-to-end experience allows us to deploy a new solution from scratch with just a few lines of code. While I was able to complete the process myself, it is advisable to involve at least two or three team members for proper planning and handling of various aspects during the setup. Automating is a relatively quick process, taking a couple of hours, but customizing and building the correct structure can be time-consuming. It may take a few months to define and build the desired end-to-end experience. The duration depends on the specific goals and customization involved.

It significantly reduces the human effort required to manage multiple AWS accounts. Instead of individually changing settings for each account, users can make changes at the Control Tower level, allowing for streamlined and time-saving account management. It also provides centralized governance and a standardized structure for various aspects like security, billing, logging, and authentication across all accounts. This centralized approach enhances efficiency and helps maintain consistency throughout the organization's AWS environment.

The pricing is efficient, not overly expensive but also not very cheap. While there are additional costs associated with managing multiple accounts using Control Tower, the service itself does not have any extra charges for account management. There may be some side costs such as centralized logging, but overall, it is a cost-effective solution. I would rate it five out of ten.

For businesses that need to handle multiple AWS accounts, implementing AWS Control Tower is highly recommended and almost mandatory. It provides the necessary features and capabilities to efficiently manage and govern multiple accounts, making it a valuable solution for such scenarios. I would rate it eight out of ten.