Permissions for configuring and provisioning accounts
The AWS Control Tower Account Factory enables cloud administrators and users in AWS IAM Identity Center to
provision accounts in your landing zone. By default, IAM Identity Center users that provision accounts must
be in the AWSAccountFactory
group or the management group.
Note
Exercise caution when working from the management account, as you would when using any account that has permissions across your organization.
The AWS Control Tower management account has a trust relationship with the
AWSControlTowerExecution
role, which allows account setup from the
management account, including some automated account setup. For more information about
the AWSControlTowerExecution
role, see Roles and accounts.
Note
To enroll an existing AWS account into AWS Control Tower, that account must have the
AWSControlTowerExecution
role enabled. For more information about
how to enroll an existing account, see Enroll an existing AWS account.
For more information about permissions, see Permissions required for accounts.