How do I resolve control drift in AWS Control Tower?

Resolution

Identify the type of control drift

To identify your type of control drift, or governance drift, complete the following steps:

1. Open the AWS Control Tower console.
2. In the navigation pane, choose Organization.
3. Select the OU or account that reports drift.
4. Choose a resolution based on the type of drift that's reported.
   If the control state shows Drifted only on the account, then you have inheritance drift. To confirm, choose the OU in the account's Inherited from field.
   If the control state shows Drifted on both the OU and the account, then see the Resolve configuration drift section.
   If the account's own ID appears instead of the OU, then see the Resolve inheritance drift section.

AWS Security Hub CSPM controls don't have their compliance status aggregated in the AWS Control Tower console. You must check the status through the Security Hub CSPM console instead. AWS Control Tower doesn't display Drifted on individual controls implemented as service control policies (SCPs). Instead, you might receive the "AWS Control Tower has detected drift in one or more preventive controls" error message.

Resolve configuration drift

Configuration drift occurs when you manually modified controls that are resource control policies (RCPs) or declarative policies.

To resolve configuration drift, re-register your OU in the AWS Control Tower console or use the ResetEnabledControl API. This resets every control on the OU to its original state.

Note: You can only re-register an OU that contains fewer than 1,000 accounts.

Resolve inheritance drift

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

When you move an account between OUs without auto-enrollment, AWS Control Tower applies the destination OU's controls. AWS Config rule-based controls from the previous OU might remain on the account. To remove remaining controls, use the DisableControl API.

If you changed an account's OU from the AWS Organizations console, then you must resolve account drift. To resolve, see How do I resolve the "Your enrolled account was moved to another OU" error in AWS Control Tower?

Or to identify and remove the inheritance-drifted control, complete the following steps:

1. Open the AWS Control Tower console.

2. In the navigation pane, choose Controls.

3. Select the control that you want to check.

4. Copy the control's Amazon Resource Name (ARN) from the API identifier field. The identifier uses the arn:aws:controlcatalog:::control/YOUR_CONTROL_ID format.

5. To list the enabled controls on the account, run the following list-enabled-controls AWS CLI command:

   aws controltower list-enabled-controls --target-identifier arn:aws:organizations::MANAGEMENT_ACCOUNT_ID:account/ORG_ID/MEMBER_ACCOUNT_ID --include-children

   Note: Replace MANAGEMENT_ACCOUNT_ID with your management account ID, ORG_ID with your organization ID, and MEMBER_ACCOUNT_ID with the ID of the moved account.

6. In the output, find the entry where the ControlIdentifier parameter matches your YOUR_CONTROL_ID and the inheritance type shows a DRIFTED status.
   Example output:

   {
       "arn": "arn:aws:controltower:REGION:MANAGEMENT_ACCOUNT_ID:enabledcontrol/ENABLED_CONTROL_ID",
       "controlIdentifier": "arn:aws:controlcatalog:::control/CONTROL_ID",
       "targetIdentifier": "arn:aws:organizations::MANAGEMENT_ACCOUNT_ID:account/ORG_ID/MEMBER_ACCOUNT_ID",
       "statusSummary": { "status": "SUCCEEDED" },
       "driftStatusSummary": {
           "driftStatus": "DRIFTED",
           "types": {
               "inheritance": { "status": "DRIFTED" },
               "resource": { "status": "IN_SYNC" }
           }
       }
   }

7. To turn off the inheritance-drifted control, run the following disable-control AWS CLI command:

   aws controltower disable-control --enabled-control-identifier arn:aws:controltower:REGION:MANAGEMENT_ACCOUNT_ID:enabledcontrol/ENABLED_CONTROL_ID

   Note: Replace REGION with your AWS Region, MANAGEMENT_ACCOUNT_ID with your management account ID, and ENABLED_CONTROL_ID with the unique ID from step 4.

Prevent inheritance drift with auto-enrollment

It's a best practice to turn on auto-enrollment to prevent this drift on future account moves. When auto-enrollment is active, AWS Control Tower applies the destination OU's baselines and control configurations to a moved account and removes the previous OU's controls.

To turn on auto-enrollment, complete the following steps:

1. Open the AWS Control Tower console.
2. In the navigation pane, choose Landing zone settings.
3. In the Account enrollment section, choose Update landing zone.
4. Set Automatically enroll accounts to ON.
5. Choose Update.

Note: Auto-enrollment doesn't remove leftover controls.

Related information

Detect and resolve drift in AWS Control Tower

Update and move accounts with AWS Control Tower