Question

A financial services company manages 120 accounts using AWS Control Tower. The security governance team wants to be automatically notified whenever a landing zone control drifts from its expected state — for example, when an SCP guardrail is manually removed from an OU or a required baseline resource is deleted in an enrolled account. They want a low-maintenance, event-driven approach that integrates with their existing incident-response tooling. What should they implement?

Accepted Answer

Create an Amazon EventBridge rule in the management account that matches Control Tower lifecycle events (such as drift detection) from the aws.controltower source and routes them to an SNS topic or their incident-response system.

Answer

Enable AWS Config in every enrolled account and write a custom Config rule that periodically evaluates each account's SCP attachment and baseline resources, reporting noncompliance to a central aggregator.

Answer

Schedule a Lambda function to call the Control Tower GetLandingZoneStatus API every hour and compare the returned configuration against a stored baseline document in S3.

Answer

Turn on AWS Security Hub in all accounts and rely on the AWS Foundational Security Best Practices standard to detect and alert on landing zone control drift.