https://www.playingaws.com//posts/aws-control-tower-deep-dive/