AWS Control Tower provides updates to access logging and exceptions to more global services for Region Deny
Today AWS Control Tower is launching Landing Zone 3.1. A landing zone is a well-architected, multi-account AWS environment that is a starting point from which you can deploy workloads and applications. AWS Control Tower automates the setup of a new landing zone using AWS best-practices blueprints for identity, federated access, logging, monitoring, and account structure. Landing Zone 3.1 includes security best practice updates for Amazon Simple Storage Service (Amazon S3) access logging and updates to exceptions in the Region Deny control.