Recursos criados nas contas compartilhadas
Esta seção mostra os recursos que o AWS Control Tower cria nas contas compartilhadas quando você configura a zona de pouso.
Consulte informações sobre os recursos de conta-membro em Considerações sobre recursos do Account Factory.
Recursos da conta de gerenciamento
Ao configurar a zona de pouso, os recursos da AWS a seguir são criados na conta de gerenciamento.
| Serviço da AWS | Tipo de recurso | Nome do recurso |
|---|---|---|
| AWS Organizations | Contas | audit log archive |
| AWS Organizations | UOs | Security Sandbox |
| AWS Organizations | Políticas de controle de serviço | aws-guardrails-* |
| AWS CloudFormation | Pilhas | AWSControlTowerBP-BASELINE-CLOUDTRAIL-MASTER AWSControlTowerBP-BASELINE-CONFIG-MASTER (na versão 2.6 e posterior) |
| AWS CloudFormation | StackSets |
AWSControlTowerBP-BASELINE-CLOUDTRAIL (mão implantado na versão 3.0 e posterior) AWSControlTowerBP_BASELINE_SERVICE_LINKED_ROLE (Deployed in 3.2 and later) AWSControlTowerBP-BASELINE-CLOUDWATCH AWSControlTowerBP-BASELINE-CONFIG AWSControlTowerBP-BASELINE-ROLES AWSControlTowerBP-BASELINE-SERVICE-ROLES AWSControlTowerBP-SECURITY-TOPICS AWSControlTowerGuardrailAWS-GR-AUDIT-BUCKET-PUBLIC-READ-PROHIBITED AWSControlTowerGuardrailAWS-GR-AUDIT-BUCKET-PUBLIC-WRITE-PROHIBITED AWSControlTowerLoggingResources AWSControlTowerSecurityResources AWSControlTowerExecutionRole |
| AWS Service Catalog | Produto | Account Factory do AWS Control Tower |
| AWS Config | Agregador | aws-controltower-ConfigAggregatorForOrganizations |
| AWS CloudTrail | Trilha | aws-controltower-BaselineCloudTrail |
| Amazon CloudWatch | CloudWatch Logs | aws-controltower/CloudTrailLogs |
| AWS Identity and Access Management | Perfis | AWSControlTowerAdmin AWSControlTowerStackSetRole AWSControlTowerCloudTrailRolePolicy |
| AWS Identity and Access Management | Políticas | AWSControlTowerServiceRolePolicy AWSControlTowerAdminPolicy AWSControlTowerCloudTrailRolePolicy AWSControlTowerStackSetRolePolicy |
| AWS IAM Identity Center | Grupos de diretórios | AWSAccountFactory AWSAuditAccountAdmins AWSControlTowerAdmins AWSLogArchiveAdmins AWSLogArchiveViewers AWSSecurityAuditors AWSSecurityAuditPowerUsers AWSServiceCatalogAdmins |
| AWS IAM Identity Center | Conjuntos de permissões | AWSAdministratorAccess AWSPowerUserAccess AWSServiceCatalogAdminFullAccess AWSServiceCatalogEndUserAccess AWSReadOnlyAccess AWSOrganizationsFullAccess |
nota
O BP_BASELINE_CLOUDTRAIL do StackSet do CloudFormation não está implantado nas versões 3.0 ou posteriores da zona de pouso. No entanto, ele continua existindo nas versões anteriores da zona de pouso, até que você a atualize.
Recursos da conta de arquivamento de logs
Ao configurar a zona de pouso, os recursos da AWS a seguir são criados na conta de arquivamento de logs.
| Serviço da AWS | Tipo de recurso | Nome do recurso |
|---|---|---|
| AWS CloudFormation | Pilhas | StackSet-AWSControlTowerGuardrailAWS-GR-AUDIT-BUCKET-PUBLIC-READ-PROHIBITED- StackSet-AWSControlTowerGuardrailAWS-GR-AUDIT-BUCKET-PUBLIC-WRITE-PROHIBITED StackSet-AWSControlTowerBP-BASELINE-CLOUDWATCH- StackSet-AWSControlTowerBP-BASELINE-CONFIG- StackSet-AWSControlTowerBP-BASELINE-CLOUDTRAIL- StackSet-AWSControlTowerBP-BASELINE-SERVICE-ROLES- StackSet-AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE-(In 3.2 and later) StackSet-AWSControlTowerBP-BASELINE-ROLES- StackSet-AWSControlTowerLoggingResources- |
| AWS Config | Regras do AWS Config | AWSControlTower_AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED AWSControlTower_AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBIT |
| AWS CloudTrail | Trilhas | aws-controltower-BaselineCloudTrail |
| Amazon CloudWatch | Regras do CloudWatch Events | aws-controltower-ConfigComplianceChangeEventRule |
| Amazon CloudWatch | CloudWatch Logs | /aws/lambda/aws-controltower-NotificationForwarder |
| AWS Identity and Access Management | Perfis | aws-controltower-AdministratorExecutionRole aws-controltower-CloudWatchLogsRole aws-controltower-ConfigRecorderRole aws-controltower-ForwardSnsNotificationRole aws-controltower-ReadOnlyExecutionRole AWSControlTowerExecution |
| AWS Identity and Access Management | Políticas | AWSControlTowerServiceRolePolicy |
| Amazon Simple Notification Service | Tópicos | aws-controltower-SecurityNotifications |
| AWS Lambda | Aplicações | StackSet-AWSControlTowerBP-BASELINE-CLOUDWATCH-* |
| AWS Lambda | Funções | aws-controltower-NotificationForwarder |
| Amazon Simple Storage Service | Buckets | aws-controltower-logs-* aws-controltower-s3-access-logs-* |
Recursos da conta de auditoria
Ao configurar a zona de pouso, os recursos da AWS a seguir são criados na conta de auditoria.
| Serviço da AWS | Tipo de recurso | Nome do recurso |
|---|---|---|
| AWS CloudFormation | Pilhas | StackSet-AWSControlTowerGuardrailAWS-GR-AUDIT-BUCKET-PUBLIC-READ-PROHIBITED- StackSet-AWSControlTowerGuardrailAWS-GR-AUDIT-BUCKET-PUBLIC-WRITE-PROHIBITED- StackSet-AWSControlTowerBP-BASELINE-CLOUDWATCH- StackSet-AWSControlTowerBP-BASELINE-CONFIG- StackSet-AWSControlTowerBP-BASELINE-CLOUDTRAIL- StackSet-AWSControlTowerBP-BASELINE-SERVICE-ROLES- StackSet-AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE-(In 3.2 and later) StackSet-AWSControlTowerBP-SECURITY-TOPICS- StackSet-AWSControlTowerBP-BASELINE-ROLES- StackSet-AWSControlTowerSecurityResources-* |
| AWS Config | Agregador | aws-controltower-GuardrailsComplianceAggregator |
| AWS Config | Regras do AWS Config | AWSControlTower_AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED AWSControlTower_AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED |
| AWS CloudTrail | Trilha | aws-controltower-BaselineCloudTrail |
| Amazon CloudWatch | Regras do CloudWatch Events | aws-controltower-ConfigComplianceChangeEventRule |
| Amazon CloudWatch | CloudWatch Logs | /aws/lambda/aws-controltower-NotificationForwarder |
| AWS Identity and Access Management | Perfis | aws-controltower-AdministratorExecutionRole aws-controltower-CloudWatchLogsRole aws-controltower-ConfigRecorderRole aws-controltower-ForwardSnsNotificationRole aws-controltower-ReadOnlyExecutionRole aws-controltower-AuditAdministratorRole aws-controltower-AuditReadOnlyRole AWSControlTowerExecution |
| AWS Identity and Access Management | Políticas | AWSControlTowerServiceRolePolicy |
| Amazon Simple Notification Service | Tópicos | aws-controltower-AggregateSecurityNotifications aws-controltower-AllConfigNotifications aws-controltower-SecurityNotifications |
| AWS Lambda | Funções | aws-controltower-NotificationForwarder |
