c2.16 Adopt a multi-account structure
Use AWS Control Tower to stand up a multi-account landing zone: enforce guardrails centrally, centralize and protect CloudTrail logs in a dedicated logging account, and delegate security administration so one team sees the whole organization.
Implementation guidance
Stand up a landing zone
AWS Control Tower sets up a best-practice multi-account environment: it enforces guardrails centrally and centralizes CloudTrail logs in a dedicated, protected logging account. If you need more customization than Control Tower offers, use the Landing Zone Accelerator on AWS.
Structure accounts to contain incidents
Split workloads across accounts: a set of core accounts (logging, audit, backups, networking) that support the organization, plus dev/test/prod accounts per business unit or workload. If today you have one big production account, start moving workloads out to shrink the blast radius of a security incident. Separate accounts also avoid contention on per-account service limits.
Delegate security administration
Many security services integrate with AWS Organizations and support a delegated administrator, so the security team gets organization-wide visibility from a dedicated security account — including AWS Security Hub CSPM, Amazon GuardDuty, Amazon Macie, Amazon Detective, AWS Firewall Manager, IAM Access Analyzer, and Amazon Inspector.
Keep the management account clean
The management (organization root) account is not restricted by SCPs and should not be used day to day, so avoid running workloads there. You can enable Control Tower on an existing organization.
How it fits together
How to validate
- Have you implemented AWS Control Tower (or a landing zone)?
- Are workloads isolated across multiple accounts?
- Is there one account that concentrates most of the organization’s workloads?
- Are security services using delegated administration from a dedicated security account?
Threats addressed
- If logs are not centralized and protected in a separate account, an adversary can tamper with or disable them, hampering eradication.
- A single-account setup cannot use SCPs, so nothing limits what a compromised credential can do; production workloads need an organization.
- Concentrating workloads in one account enlarges the blast radius of any compromise.
AWS services
AWS Organizations 
AWS Control Tower 
AWS Security Hub 
Amazon GuardDuty Pricing
AWS Control Tower has no additional charge beyond the services it enables (such as AWS Config). See Control Tower pricing.