enabled_controls

Creates, updates, deletes, gets or lists an enabled_controls resource.

Overview

Name	enabled_controls
Type	Resource
Id	aws.controltower.enabled_controls

Fields

The following fields are returned by SELECT queries:

get_enabled_control

Name	Datatype	Description
arn	string	The ARN of the enabled control. (pattern: <code>arn:aws[0-9a-zA-Z_-:/]+</code>)
control_identifier	string	The control identifier of the enabled control. For information on how to find the controlIdentifier, see the overview page. (pattern: <code>arn:aws[0-9a-zA-Z_-:/]+</code>)
drift_status_summary	object	The drift status of the enabled control.
parameters	array	Array of EnabledControlParameter objects.
parent_identifier	string	The ARN of the parent enabled control from which this control inherits its configuration, if applicable. (pattern: <code>arn:aws[0-9a-zA-Z_-:/]+</code>)
status_summary	object	The deployment summary of an EnabledControl or EnabledBaseline resource.
target_identifier	string	The ARN of the organizational unit. For information on how to find the targetIdentifier, see the overview page. (pattern: <code>arn:aws[0-9a-zA-Z_-:/]+</code>)
target_regions	array	Target Amazon Web Services Regions for the enabled control.

list_enabled_controls

Name	Datatype	Description
arn	string	The ARN of the enabled control. (pattern: <code>arn:aws[0-9a-zA-Z_-:/]+</code>)
control_identifier	string	The controlIdentifier of the enabled control. (pattern: <code>arn:aws[0-9a-zA-Z_-:/]+</code>)
drift_status_summary	object	The drift status of the enabled control.
parent_identifier	string	The ARN of the parent enabled control from which this control inherits its configuration, if applicable. (pattern: <code>arn:aws[0-9a-zA-Z_-:/]+</code>)
status_summary	object	The deployment summary of an EnabledControl or EnabledBaseline resource.
target_identifier	string	The ARN of the organizational unit. (pattern: <code>arn:aws[0-9a-zA-Z_-:/]+</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_enabled_control	select	region		Retrieves details about an enabled control. For usage examples, see the Controls Reference Guide .
list_enabled_controls	select	region		Lists the controls enabled by Amazon Web Services Control Tower on the specified organizational unit and the accounts it contains. For usage examples, see the Controls Reference Guide .
update_enabled_control	update	region, parameters, enabledControlIdentifier		Updates the configuration of an already enabled control. If the enabled control shows an EnablementStatus of SUCCEEDED, supply parameters that are different from the currently configured parameters. Otherwise, Amazon Web Services Control Tower will not accept the request. If the enabled control shows an EnablementStatus of FAILED, Amazon Web Services Control Tower updates the control to match any valid parameters that you supply. If the DriftSummary status for the control shows as DRIFTED, you cannot call this API. Instead, you can update the control by calling the ResetEnabledControl API. Alternatively, you can call DisableControl and then call EnableControl again. Also, you can run an extending governance operation to repair drift. For usage examples, see the Controls Reference Guide .
reset_enabled_control	exec	region, enabledControlIdentifier		Resets an enabled control. Does not work for controls implemented with SCPs.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

get_enabled_control

Retrieves details about an enabled control. For usage examples, see the Controls Reference Guide .

SELECT
arn,
control_identifier,
drift_status_summary,
parameters,
parent_identifier,
status_summary,
target_identifier,
target_regions
FROM aws.controltower.enabled_controls
WHERE region = '{{ region }}' -- required
;

list_enabled_controls

Lists the controls enabled by Amazon Web Services Control Tower on the specified organizational unit and the accounts it contains. For usage examples, see the Controls Reference Guide .

SELECT
arn,
control_identifier,
drift_status_summary,
parent_identifier,
status_summary,
target_identifier
FROM aws.controltower.enabled_controls
WHERE region = '{{ region }}' -- required
;

UPDATE examples

update_enabled_control

Updates the configuration of an already enabled control. If the enabled control shows an EnablementStatus of SUCCEEDED, supply parameters that are different from the currently configured parameters. Otherwise, Amazon Web Services Control Tower will not accept the request. If the enabled control shows an EnablementStatus of FAILED, Amazon Web Services Control Tower updates the control to match any valid parameters that you supply. If the DriftSummary status for the control shows as DRIFTED, you cannot call this API. Instead, you can update the control by calling the ResetEnabledControl API. Alternatively, you can call DisableControl and then call EnableControl again. Also, you can run an extending governance operation to repair drift. For usage examples, see the Controls Reference Guide .

UPDATE aws.controltower.enabled_controls
SET 
parameters = '{{ parameters }}',
enabledControlIdentifier = '{{ enabledControlIdentifier }}'
WHERE 
region = '{{ region }}' --required
AND parameters = '{{ parameters }}' --required
AND enabledControlIdentifier = '{{ enabledControlIdentifier }}' --required
RETURNING
operation_identifier;

Lifecycle Methods

reset_enabled_control

Resets an enabled control. Does not work for controls implemented with SCPs.

EXEC aws.controltower.enabled_controls.reset_enabled_control 
@region='{{ region }}' --required 
@@json=
'{
"enabledControlIdentifier": "{{ enabledControlIdentifier }}"
}'
;