AWS Control Tower vs. OpsCompass

We were wanting to prove the concept of a low touch process for quickly spinning up boilerplate AWS environments. We were able to get started quickly and to ensure that the AWS Well-Architected Framework principles were followed - at least upfront - however, we found that for our use case and expertise level it ultimately wasn't a fit. We have the skills on our team to manage more of this on our own. My recommendation would be contingent on what skills are already available on your team: if you can "do it yourself" you might as well so that you don't pay for resources you don't need and you have finer grain control over what's created.

Incentivized

We previously had separate products to manage Azure and AWS, each with different capabilities, and it was very complex for our team to go back and forth and try to make sense of each environment. OpsCompass is very well suited to give you a single view of our entire cloud environment. OpsCompass also brings excellent compliance policies. We were not highly skilled with these policies, but the product made it easy to perform an assessment of our current state and identify areas where we had non-compliance issues. CIS policies were a great area to start and we later tried the Microsoft 365 policies, which were also helpful. More policies would be great to see.

• Easily create new AWS accounts.
• Easily secure and manage AWS accounts.
• Landing zone with SSO is a huge win for larger teams.

Incentivized

• Quick inventory of all my cloud resources
• Detects changes to my cloud resources--including the source of the changes (user or system)
• Cost impacts of changes to my cloud infrastructure

• The AWS SSO GUI is not very intuitive and determining how to apply policies to users without creating redundant logins has been a challenge.
• The default guardrails do not fully encompass all the security checks that we needed.
• There does not appear to be any way to control roles at the IAM level from the control tower account through the GUI.
• Some features on AWS accounts still require logging into the individual account with the root user and cannot be done from AWS Control Tower.

Incentivized

• I would like to see more integrations to help surface alerts. Slack would be great, as an example.
• An imbedded tour or onboarding would help our new users, but overall, the product is pretty easy to figure out

Using AWS Systems Manager and other slightly lower level components has been helpful for us to manage parts of our AWS presence at a more granular level than AWS Control Tower was designed for. It's not at all an apples-to-apples comparison as they solve different use cases, but for us, the use case associated with AWS Systems Manager was a better fit for our specific needs and skillsets. We did not need everything that AWS Control Tower was doing for us.

Incentivized

In this price range, we didn't find any other tools that provide this degree of cloud resource visibility. It's been an efficiency game-changer. I hope we'll see new modules as they expand their features to include active resource management policies. They've done such a good job of anticipating the needs of our CloudOps team, I plan to evaluate those new features (if/when they arrive).

• Less time manually deploying accounts which was error prone.
• Central logging allowed us to have 1 place to view logs.

Incentivized

• Our team was able to do roughly 30% more with the product. The automation helps us spot issues without a lot of manual work
• We identified changes that would have had a massive cost impact--spinning up or forgetting about infrastructure we didn't need.
• OpsCompass prevents configuration drift and maintains a healthy state across multi-clouds.