2023/10/12 - AWS Control Tower - 1 new 1 updated api methods
Changes Added new EnabledControl resource details to ListEnabledControls API and added new GetEnabledControl API.
Provides details about the enabled control. For usage examples, see the AWS Control Tower User Guide.
Returned values
TargetRegions: Shows target AWS Regions where the enabled control is available to be deployed.
StatusSummary: Provides a detailed summary of the deployment status.
DriftSummary: Provides a detailed summary of the drifted status.
See also: AWS API Documentation
Request Syntax
client.get_enabled_control(
enabledControlIdentifier='string'
)
string
[REQUIRED]
The ARN of the enabled control.
dict
Response Syntax
{
'enabledControlDetails': {
'arn': 'string',
'controlIdentifier': 'string',
'driftStatusSummary': {
'driftStatus': 'DRIFTED'|'IN_SYNC'|'NOT_CHECKING'|'UNKNOWN'
},
'statusSummary': {
'lastOperationIdentifier': 'string',
'status': 'SUCCEEDED'|'FAILED'|'UNDER_CHANGE'
},
'targetIdentifier': 'string',
'targetRegions': [
{
'name': 'string'
},
]
}
}
Response Structure
(dict) --
enabledControlDetails (dict) --
Information about the enabled control.
arn (string) --
The ARN of the enabled control.
controlIdentifier (string) --
The control identifier of the enabled control. For information on how to find the controlIdentifier , see the overview page.
driftStatusSummary (dict) --
The drift status of the enabled control.
driftStatus (string) --
The drift status of the enabled control.
Valid values:
DRIFTED : The enabledControl deployed in this configuration doesn’t match the configuration that AWS Control Tower expected.
IN_SYNC : The enabledControl deployed in this configuration matches the configuration that AWS Control Tower expected.
NOT_CHECKING : AWS Control Tower does not check drift for this enabled control. Drift is not supported for the control type.
UNKNOWN : AWS Control Tower is not able to check the drift status for the enabled control.
statusSummary (dict) --
The deployment summary of the enabled control.
lastOperationIdentifier (string) --
The last operation identifier for the enabled control.
status (string) --
The deployment status of the enabled control.
Valid values:
SUCCEEDED : The enabledControl configuration was deployed successfully.
UNDER_CHANGE : The enabledControl configuration is changing.
FAILED : The enabledControl configuration failed to deploy.
targetIdentifier (string) --
The ARN of the organizational unit. For information on how to find the targetIdentifier , see the overview page.
targetRegions (list) --
Target AWS Regions for the enabled control.
(dict) --
An AWS Region in which AWS Control Tower expects to find the control deployed.
The expected Regions are based on the Regions that are governed by the landing zone. In certain cases, a control is not actually enabled in the Region as expected, such as during drift, or mixed governance.
name (string) --
The AWS Region name.
{'enabledControls': {'arn': 'string',
'driftStatusSummary': {'driftStatus': 'DRIFTED | IN_SYNC '
'| NOT_CHECKING | '
'UNKNOWN'},
'statusSummary': {'lastOperationIdentifier': 'string',
'status': 'SUCCEEDED | FAILED | '
'UNDER_CHANGE'},
'targetIdentifier': 'string'}}
Lists the controls enabled by AWS Control Tower on the specified organizational unit and the accounts it contains. For usage examples, see the AWS Control Tower User Guide
See also: AWS API Documentation
Request Syntax
client.list_enabled_controls(
maxResults=123,
nextToken='string',
targetIdentifier='string'
)
integer
How many results to return per API call.
string
The token to continue the list from a previous API call with the same parameters.
string
[REQUIRED]
The ARN of the organizational unit. For information on how to find the targetIdentifier , see the overview page.
dict
Response Syntax
{
'enabledControls': [
{
'arn': 'string',
'controlIdentifier': 'string',
'driftStatusSummary': {
'driftStatus': 'DRIFTED'|'IN_SYNC'|'NOT_CHECKING'|'UNKNOWN'
},
'statusSummary': {
'lastOperationIdentifier': 'string',
'status': 'SUCCEEDED'|'FAILED'|'UNDER_CHANGE'
},
'targetIdentifier': 'string'
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
enabledControls (list) --
Lists the controls enabled by AWS Control Tower on the specified organizational unit and the accounts it contains.
(dict) --
A summary of enabled controls.
arn (string) --
The ARN of the enabled control.
controlIdentifier (string) --
The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny control. For information on how to find the controlIdentifier , see the overview page.
driftStatusSummary (dict) --
The drift status of the enabled control.
driftStatus (string) --
The drift status of the enabled control.
Valid values:
DRIFTED : The enabledControl deployed in this configuration doesn’t match the configuration that AWS Control Tower expected.
IN_SYNC : The enabledControl deployed in this configuration matches the configuration that AWS Control Tower expected.
NOT_CHECKING : AWS Control Tower does not check drift for this enabled control. Drift is not supported for the control type.
UNKNOWN : AWS Control Tower is not able to check the drift status for the enabled control.
statusSummary (dict) --
lastOperationIdentifier (string) --
The last operation identifier for the enabled control.
status (string) --
The deployment status of the enabled control.
Valid values:
SUCCEEDED : The enabledControl configuration was deployed successfully.
UNDER_CHANGE : The enabledControl configuration is changing.
FAILED : The enabledControl configuration failed to deploy.
targetIdentifier (string) --
The ARN of the organizational unit.
nextToken (string) --
Retrieves the next page of results. If the string is empty, the current response is the end of the results.