AWS API Changes

2024/05/20 - AWS Control Tower - 1 new2 updated api methods

Changes Added ListControlOperations API and filtering support for ListEnabledControls API. Updates also includes added metadata for enabled controls and control operations.

ListControlOperations (new)

Link ¶

Provides a list of operations in progress or queued.

See also: AWS API Documentation

Request Syntax

client.list_control_operations(
    filter={
        'controlIdentifiers': [
            'string',
        ],
        'controlOperationTypes': [
            'ENABLE_CONTROL'|'DISABLE_CONTROL'|'UPDATE_ENABLED_CONTROL',
        ],
        'enabledControlIdentifiers': [
            'string',
        ],
        'statuses': [
            'SUCCEEDED'|'FAILED'|'IN_PROGRESS',
        ],
        'targetIdentifiers': [
            'string',
        ]
    },
    maxResults=123,
    nextToken='string'
)

type filter:

dict

param filter:

An input filter for the ListControlOperations API that lets you select the types of control operations to view.

controlIdentifiers (list) --

The set of controlIdentifier returned by the filter.
- (string) --
controlOperationTypes (list) --

The set of ControlOperation objects returned by the filter.
- (string) --
enabledControlIdentifiers (list) --

The set controlIdentifier of enabled controls selected by the filter.
- (string) --
statuses (list) --

Lists the status of control operations.
- (string) --
targetIdentifiers (list) --

The set of targetIdentifier objects returned by the filter.
- (string) --

type maxResults:

integer

param maxResults:

The maximum number of results to be shown.

type nextToken:

string

param nextToken:

A pagination token.

rtype:

dict

returns:

Response Syntax

{
    'controlOperations': [
        {
            'controlIdentifier': 'string',
            'enabledControlIdentifier': 'string',
            'endTime': datetime(2015, 1, 1),
            'operationIdentifier': 'string',
            'operationType': 'ENABLE_CONTROL'|'DISABLE_CONTROL'|'UPDATE_ENABLED_CONTROL',
            'startTime': datetime(2015, 1, 1),
            'status': 'SUCCEEDED'|'FAILED'|'IN_PROGRESS',
            'statusMessage': 'string',
            'targetIdentifier': 'string'
        },
    ],
    'nextToken': 'string'
}

Response Structure

(dict) --
- controlOperations (list) --
  
  Returns a list of output from control operations. PLACEHOLDER
  - (dict) --
    
    A summary of information about the specified control operation.
    - controlIdentifier (string) --
      
      The controlIdentifier of a control.
    - enabledControlIdentifier (string) --
      
      The controlIdentifier of an enabled control.
    - endTime (datetime) --
      
      The time at which the control operation was completed.
    - operationIdentifier (string) --
      
      The unique identifier of a control operation.
    - operationType (string) --
      
      The type of operation.
    - startTime (datetime) --
      
      The time at which a control operation began.
    - status (string) --
      
      The status of the specified control operation.
    - statusMessage (string) --
      
      A speficic message displayed as part of the control status.
    - targetIdentifier (string) --
      
      The unique identifier of the target of a control operation.
- nextToken (string) --
  
  A pagination token.

GetControlOperation (updated)

Link ¶
Changes (response)

{'controlOperation': {'controlIdentifier': 'string',
                      'enabledControlIdentifier': 'string',
                      'operationIdentifier': 'string',
                      'targetIdentifier': 'string'}}

Returns the status of a particular EnableControl or DisableControl operation. Displays a message in case of error. Details for an operation are available for 90 days. For usage examples, see the Amazon Web Services Control Tower User Guide.

See also: AWS API Documentation

Request Syntax

client.get_control_operation(
    operationIdentifier='string'
)

type operationIdentifier:

string

param operationIdentifier:

[REQUIRED]

The ID of the asynchronous operation, which is used to track status. The operation is available for 90 days.

rtype:

dict

returns:

Response Syntax

{
    'controlOperation': {
        'controlIdentifier': 'string',
        'enabledControlIdentifier': 'string',
        'endTime': datetime(2015, 1, 1),
        'operationIdentifier': 'string',
        'operationType': 'ENABLE_CONTROL'|'DISABLE_CONTROL'|'UPDATE_ENABLED_CONTROL',
        'startTime': datetime(2015, 1, 1),
        'status': 'SUCCEEDED'|'FAILED'|'IN_PROGRESS',
        'statusMessage': 'string',
        'targetIdentifier': 'string'
    }
}

Response Structure

(dict) --
- controlOperation (dict) --
  
  An operation performed by the control.
  - controlIdentifier (string) --
    
    The controlIdentifier of the control for the operation.
  - enabledControlIdentifier (string) --
    
    The controlIdentifier of the enabled control.
  - endTime (datetime) --
    
    The time that the operation finished.
  - operationIdentifier (string) --
    
    The identifier of the specified operation.
  - operationType (string) --
    
    One of ENABLE_CONTROL or DISABLE_CONTROL.
  - startTime (datetime) --
    
    The time that the operation began.
  - status (string) --
    
    One of IN_PROGRESS, SUCEEDED, or FAILED.
  - statusMessage (string) --
    
    If the operation result is FAILED, this string contains a message explaining why the operation failed.
  - targetIdentifier (string) --
    
    The target upon which the control operation is working.

ListEnabledControls (updated)

Link ¶
Changes (request)

{'filter': {'controlIdentifiers': ['string'],
            'driftStatuses': ['DRIFTED | IN_SYNC | NOT_CHECKING | UNKNOWN'],
            'statuses': ['SUCCEEDED | FAILED | UNDER_CHANGE']}}

Lists the controls enabled by Amazon Web Services Control Tower on the specified organizational unit and the accounts it contains. For usage examples, see the Amazon Web Services Control Tower User Guide.

See also: AWS API Documentation

Request Syntax

client.list_enabled_controls(
    filter={
        'controlIdentifiers': [
            'string',
        ],
        'driftStatuses': [
            'DRIFTED'|'IN_SYNC'|'NOT_CHECKING'|'UNKNOWN',
        ],
        'statuses': [
            'SUCCEEDED'|'FAILED'|'UNDER_CHANGE',
        ]
    },
    maxResults=123,
    nextToken='string',
    targetIdentifier='string'
)

type filter:

dict

param filter:

An input filter for the ListCEnabledControls API that lets you select the types of control operations to view.

controlIdentifiers (list) --

The set of controlIdentifier returned by the filter.
- (string) --
driftStatuses (list) --

A list of DriftStatus items.
- (string) --
statuses (list) --

A list of EnablementStatus items.
- (string) --

type maxResults:

integer

param maxResults:

How many results to return per API call.

type nextToken:

string

param nextToken:

The token to continue the list from a previous API call with the same parameters.

type targetIdentifier:

string

param targetIdentifier:

The ARN of the organizational unit. For information on how to find the targetIdentifier, see the overview page.

rtype:

dict

returns:

Response Syntax

{
    'enabledControls': [
        {
            'arn': 'string',
            'controlIdentifier': 'string',
            'driftStatusSummary': {
                'driftStatus': 'DRIFTED'|'IN_SYNC'|'NOT_CHECKING'|'UNKNOWN'
            },
            'statusSummary': {
                'lastOperationIdentifier': 'string',
                'status': 'SUCCEEDED'|'FAILED'|'UNDER_CHANGE'
            },
            'targetIdentifier': 'string'
        },
    ],
    'nextToken': 'string'
}

Response Structure

(dict) --
- enabledControls (list) --
  
  Lists the controls enabled by Amazon Web Services Control Tower on the specified organizational unit and the accounts it contains.
  - (dict) --
    
    Returns a summary of information about an enabled control.
    - arn (string) --
      
      The ARN of the enabled control.
    - controlIdentifier (string) --
      
      The controlIdentifier of the enabled control.
    - driftStatusSummary (dict) --
      
      The drift status of the enabled control.
      - driftStatus (string) --
        
        The drift status of the enabled control.
        
        Valid values:
        
        DRIFTED: The enabledControl deployed in this configuration doesn’t match the configuration that Amazon Web Services Control Tower expected.
        
        IN_SYNC: The enabledControl deployed in this configuration matches the configuration that Amazon Web Services Control Tower expected.
        
        NOT_CHECKING: Amazon Web Services Control Tower does not check drift for this enabled control. Drift is not supported for the control type.
        
        UNKNOWN: Amazon Web Services Control Tower is not able to check the drift status for the enabled control.
    - statusSummary (dict) --
      
      A short description of the status of the enabled control.
      - lastOperationIdentifier (string) --
        
        The last operation identifier for the enabled control.
      - status (string) --
        
        The deployment status of the enabled control.
        
        Valid values:
        
        SUCCEEDED: The enabledControl configuration was deployed successfully.
        
        UNDER_CHANGE: The enabledControl configuration is changing.
        
        FAILED: The enabledControl configuration failed to deploy.
    - targetIdentifier (string) --
      
      The ARN of the organizational unit.
- nextToken (string) --
  
  Retrieves the next page of results. If the string is empty, the response is the end of the results.