Although there are instructions for Decommissioning a Landing Zone in the AWS Control Tower documentation it is strongly recommended that you keep them this quest in place unless you are decommissioning your AWS account structure. The steps in this quest are intended to improve your security posture and tearing down this quest will remove the audit logs and guard rails put in place.

There is no additional cost for AWS Control Tower, you only pay for the services used by Control Tower which scales with you. See the AWS Control Tower pricing page for detailed examples. As a baseline, the setup of just Control Tower has a US$5/month fee for a product in Service Catalogue in additional to a once off cost of US$0.011 for AWS Config to record it’s initial state. Security Hub and Guard Duty both have a 30 day free trial to give you an indicative cost. Security Hub has a cost associated with number of security checks and findings ingested which will scale with your AWS usage, see AWS Secuity Hub pricing for examples. Guard Duty pricing is based on the total amount of logs consumed by the service, this will also scale cost effectively with your AWS usage, see AWS Guard Duty pricing for examples. Note that you may also additionally incur tax based on your location.

Additional Resources and next steps