AWS Control Tower vs. Plixer Scrutinizer

We were wanting to prove the concept of a low touch process for quickly spinning up boilerplate AWS environments. We were able to get started quickly and to ensure that the AWS Well-Architected Framework principles were followed - at least upfront - however, we found that for our use case and expertise level it ultimately wasn't a fit. We have the skills on our team to manage more of this on our own. My recommendation would be contingent on what skills are already available on your team: if you can "do it yourself" you might as well so that you don't pay for resources you don't need and you have finer grain control over what's created.

Incentivized

If you need a network security forensic tool, this is a great fit. Scrutinizer collects everything you have configured as a target without losing data. If you need an in-depth analysis of your network flows, as in who is doing what with what this is a good fit. Scrutinizer translates a massive about of data into readable tables and reports.

Incentivized

• Easily create new AWS accounts.
• Easily secure and manage AWS accounts.
• Landing zone with SSO is a huge win for larger teams.

Incentivized

• Once configured, Scrutinizer gives an accurate overview of network activity.
• Scrutinizer is able to collect flows from a variety of devices, you are not limited to Cisco.
• DSCP based reporting, which is helpful when attempting to determine how good your wireless network is from a QoS perspective.

Incentivized

• The AWS SSO GUI is not very intuitive and determining how to apply policies to users without creating redundant logins has been a challenge.
• The default guardrails do not fully encompass all the security checks that we needed.
• There does not appear to be any way to control roles at the IAM level from the control tower account through the GUI.
• Some features on AWS accounts still require logging into the individual account with the root user and cannot be done from AWS Control Tower.

Incentivized

• The free version has some limitations that make an accurate evaluation difficult, every day at midnight the data is flushed and you start over.
• If you are purchasing the appliance, you won't have admin access to it.
• Reporting could use some polished graphics and advance filtering features.

Incentivized

There is no way to easily close an AWS account whether it was created manually or via the AWS Control Tower. It takes too many steps to close it vs to provision a new AWS account

Incentivized

Support is support, they are either there or they are not. Scrutinizer support has been there every time I've needed them. They rely a bit too much on email correspondence, sometimes I want a voice to tell me what to do, and fast

Incentivized

Using AWS Systems Manager and other slightly lower level components has been helpful for us to manage parts of our AWS presence at a more granular level than AWS Control Tower was designed for. It's not at all an apples-to-apples comparison as they solve different use cases, but for us, the use case associated with AWS Systems Manager was a better fit for our specific needs and skillsets. We did not need everything that AWS Control Tower was doing for us.

Incentivized

Scrutinizer is a faster and simpler deployment while still delivering the tools and reports needed to gain accurate view traffic and network usage. Its cheaper than most alternatives and daily use is focused on understanding data, not making config changes so you can understand data. Risk reduction and elimination is the primary focus, Scrutinizer helps you do that.

Incentivized

• Less time manually deploying accounts which was error prone.
• Central logging allowed us to have 1 place to view logs.

Incentivized

• Scrutinizer is a great tool, extremely easy to implement, it lets you see your NetFlow without a large outlay.
• WAN traffic monitoring gives you the ability to accurately predict the necessary bandwidth volume, you can now stop over buying.

Incentivized