I believe AWS Control Tower could be improved. I compare it with Huawei Cloud's enterprise project, which is a similar concept but different implementation. In Huawei Cloud, you partition in one single account, but in AWS, you have to separate many accounts. You end up with maybe 20 or 30 accounts if you try to separate. It has limitations; you pay a fixed amount for 15 accounts, but if you exceed that, you have to pay more. It could be useful for implementing a Cloud Center of Excellence (CCOE) for multiple organizations, but for one organization, I would advise against it; it is too much overhead and adds hidden costs. There are limitations on the Landing Zone feature as well. If we implement AWS Control Tower, we need to implement Landing Zone and the security policy, guardrails, and Account Factory; it is not one single product. Using another cloud's enterprise project, you can just create the project and manage it already. It requires some learning curve to get hands-on. For pricing and licensing of AWS Control Tower, it has hidden costs. The Control Tower itself does not cost much, but the child accounts created from AWS Control Tower add costs for checking all configurations, logging, and metrics.
