You are looking to get into AWS for the first time, you may know a bit about platform architecture such as Regions, Availability Zones, EC2, S3, VPN's etc but you may not know that there is a whole other space around procurement, billing, and AWS account, organization and OU structure that needs to be considered as part of any enterprise-grade service, especially at scale.

Here are some useful resources to get you started down that path.

Useful YouTube Videos

What is AWS Control Tower

Using AWS Control Tower to Govern Multi-Account AWS Environments (GRC313-R)

Using AWS Control Tower to Govern Multi-Account AWS Environments (GRC313-R)

Build governance at scale with AWS Control Tower

 AWS Control Tower Tutorial / Deep Dive / Demo - Implement AWS Landing zone using AWS Control Tower

 Provisioning Users in AWS Control Tower Using AWS SSO

How to onboard existing AWS accounts onto AWS Control Tower

AWS Control Tower Well Architected Deployment

AWS Control Tower: Easiest way to set up and govern AWS at scale

Programmatically Create an AWS Account with AWS Control Tower

Useful Articles from around the Wen

My Architecture: AWS Control Tower vs AWS Landing Zone

Both Control Tower and Landing Zone help set up and manage secure multi-account AWS environments. Which one should customers use? Let's take a closer look and figure out together.

[Read more]https://www.mitocgroup.com/blog/my-architecture-aws-control-tower-vs-aws-landing-zone/

AWS Landing Zone versus AWS Control Tower

AWS Landing Zone and AWS Control Tower help set up and govern a new, secure, multi-account AWS environment based on AWS best practices. Both consist of core accounts and resources which will implement an initial security baseline. The following table compares the managed service (AWS Control Tower) with the solution (AWS Landing Zone).

This article also includes some great references

Read more

When to Migrate from AWS Landing Zone to AWS Control Tower

Landing zones have traditionally been how enterprises would address this concern, as they use a best practice security approach to help ensure the safe setup of AWS accounts. Yet, with the introduction of AWS Control Tower, enterprises may consider migrating from AWS Landing Zone to AWS Control Tower. Today we’ll walk you through why you might want to migrate, but first, we’ll start with a little background.

Amazon knows that when you have multiple AWS accounts, it can be hard to manage, control and secure all of them in one go. Enter AWS Control Tower. It combines power and simplicity, making it easy to set up, govern and secure your multiple accounts using built-in services from AWS like AWS Organizations, AWS Service Catalog, AWS Single Sign-on, AWS IAM, AWS Config, AWS Cloudtrail, and more. This combination of services makes life easy and secure for your AWS accounts. You can also provision new accounts very quickly using the Control Tower dashboard with limited steps. Last, it also provides built-in guardrails to protect your accounts.

Read more

Reddit : Landing Zone vs. Control Tower?

AWS Control Tower: Everything You Need To Know

You may have heard of AWS Control Tower, AWS Organizations and AWS Service Catalog – but what are these services and how do they integrate with one another? What are the benefits of leveraging Control Tower and the underlying services? If you’re interested to learn more, please read on and we’ll answer these questions and more below.

What Is AWS Control Tower?

AWS Control Tower automates the ‘ at scale’ build out of a multi account structure on AWS. For large companies migrating to AWS, it makes sense to have a multi account architecture, as different business functions will have different access requirements, compliance requirements and so on – these functions can be segregated easily between accounts. With AWS Control Tower, administrators can set up a new multi-account environment with a single click in the AWS Management Console.

AWS Control Tower creates an orchestration layer for other AWS services including AWS Organizations, AWS Service Catalog and AWS Single Sign-on – this Orchestration layer makes it easier for administrators who are managing more than a handful of AWS accounts.

Read more

Setting Up AWS Landing Zone with AWS Control Tower

Many years ago, I was working in a company where everything had to be created from scratch. Defining the requirements, designing the Rack, configuring the firewall, routers, and storage to be able to save data, defining user management, how to create all the infrastructure, and the list went on and on. This was a definitive infrastructure that hosted all customers and then managed them. Today, the way of thinking and drawing the entire infrastructure has changed. It has become much simpler thanks to flexibility and automation tools, but many of the requirements are the same.

When we start thinking about AWS and what customers want to do on AWS, we need to first think about requirements to better understand what the customers need. For example, which is the right service to use? What about security, governance, and baseline? How many accounts should I create for my customer based on own use cases? How many users, groups, and what permissions should they have?

Let me introduce you to the concept of a Landing Zone and Control Tower, and why they work well together.

Read more

More Reddit: AWS Control Tower Landing Zone questions

Slide shows

Implementing your landing zone

AWS Landing Zone step by step

Architecting Security & Governance Across Your AWS Landing Zone

Using AWS Control Tower to govern multi-account AWS environments at scale