Landing zone 4.0 made almost everything in Control Tower optional: Config, CloudTrail, security roles, Backup, even the Security OU. You can now use its 750-plus managed controls without a landing zone at all. What changed, what to enable, and when Control Tower is the wrong tool.
Control Tower used to be all or nothing. It created a Security OU, a log archive and audit account, an organization trail, Config in every account and IAM Identity Center, and it treated any change made outside its console as drift. Teams with an existing organization often could not adopt it without rebuilding.
Landing zone 4.0, released November 17, 2025, removed most of that. Four days later AWS added a controls-dedicated experience: the managed controls without the landing zone.
Service integrations are optional. AWS Config, CloudTrail, security roles and AWS Backup can each be enabled or disabled, and disabling one cleans up what Control Tower deployed for it. Disabling Config also requires disabling security roles, IAM Identity Center and Backup.
No required OU structure. The Security OU is no longer mandatory; the only rule is that the hub accounts share an OU.
Dedicated resources: separate S3 buckets for Config and CloudTrail and separate SNS topics per service, instead of shared ones.
A service-linked Config aggregator replaces the organization and account aggregators.
The manifest is optional, so a landing zone can start with no integrations and grow.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Control Catalog grew by 223 Config controls in April and 279 more in November 2025, and maps controls to ten industry frameworks, including PCI DSS 4.0.
Detective controls deploy as service-linked Config rules instead of StackSets. Faster, and they can no longer drift. Remediation configurations you added to those rules yourself are removed on transition.
Automatic enrollment (October 2025): move an account into a registered OU and it gets that OU's baseline and controls; move it out and they are removed.
SCPs attached outside Control Tower to managed OUs or accounts no longer cause drift.
Control Tower APIs are reachable through PrivateLink and dual-stack endpoints.
Decide the OU structure before touching the console: typically Security, Infrastructure, Workloads (with Prod and Non-Prod beneath) and Sandbox. Fewer OUs is easier to govern.
Enable the landing zone in your primary Region with only the integrations you will actually use, and add governed Regions deliberately; each one adds Config cost.
Turn on a short list of preventive controls first: deny leaving the organization, deny disabling CloudTrail and Config, deny root user actions, Region deny for Regions you do not use.
Add RCPs for the data perimeter on S3, KMS, STS, SQS and Secrets Manager. Control Tower manages RCPs for those five; newer RCP-supported services need custom policies.
Add detective controls by framework only after the preventive ones are stable, and route findings into Security Hub.
Vend accounts through Account Factory (or AFT) from day one, so no account exists outside the process.
A single-account company does not need it. An organization already governed by mature Terraform for Organizations, SCPs and logging gains little beyond the managed control catalog, which the controls-dedicated experience now provides on its own. Control Tower is most useful from about five accounts upward, when account vending and consistent guardrails stop being something one person can keep in their head.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
AWS Organizations Policies in 2026: SCPs, RCPs, Declarative Policies and Centralized Root Access
Four controls that look similar and do different jobs. SCPs cap what your principals can do, RCPs cap what can be done to your resources by anyone, declarative policies pin service settings, and centralized root access removes root credentials from member accounts. Which to use for what.
Read
AWS Spend Limits: The Limitations, and What to Do About Each
Spend limits only work on projects created through the new AWS signup experience, can't cover an existing account or an organization, can't spare production while stopping the rest, and pause everything at once. Each limitation, what it means in practice, and the workaround until AWS extends the feature.
Read
As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.