landing_zones

Creates, updates, deletes, gets or lists a landing_zones resource.

Overview

Name	landing_zones
Type	Resource
Id	aws.controltower.landing_zones

Fields

The following fields are returned by SELECT queries:

get_landing_zone

Name	Datatype	Description
arn	string	The ARN of the landing zone. (pattern: <code>arn:aws[0-9a-zA-Z_-:/]+</code>)
drift_status	object	The drift status of the landing zone.
latest_available_version	string	The latest available version of the landing zone. (pattern: <code>\d+.\d+</code>)
manifest	object	The landing zone manifest JSON text file that specifies the landing zone configurations.
remediation_types	array	The types of remediation actions configured for the landing zone, such as automatic drift correction or compliance enforcement.
status	string	The landing zone deployment status. One of ACTIVE, PROCESSING, FAILED. (ACTIVE, PROCESSING, FAILED)
version	string	The landing zone's current deployed version. (pattern: <code>\d+.\d+</code>)

list_landing_zones

Name	Datatype	Description
arn	string	The ARN of the landing zone. (pattern: <code>arn:aws[0-9a-zA-Z_-:/]+</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_landing_zone	select	region		Returns details about the landing zone. Displays a message in case of error.
list_landing_zones	select	region		Returns the landing zone ARN for the landing zone deployed in your managed account. This API also creates an ARN for existing accounts that do not yet have a landing zone ARN. Returns one landing zone ARN.
create_landing_zone	insert	region, version		Creates a new landing zone. This API call starts an asynchronous operation that creates and configures a landing zone, based on the parameters specified in the manifest JSON file.
update_landing_zone	update	region, version, landingZoneIdentifier		This API call updates the landing zone. It starts an asynchronous operation that updates the landing zone based on the new landing zone version, or on the changed parameters specified in the updated manifest file.
delete_landing_zone	delete	region		Decommissions a landing zone. This API call starts an asynchronous operation that deletes Amazon Web Services Control Tower resources deployed in accounts managed by Amazon Web Services Control Tower. Decommissioning a landing zone is a process with significant consequences, and it cannot be undone. We strongly recommend that you perform this decommissioning process only if you intend to stop using your landing zone.
reset_landing_zone	exec	region, landingZoneIdentifier		This API call resets a landing zone. It starts an asynchronous operation that resets the landing zone to the parameters specified in the original configuration, which you specified in the manifest file. Nothing in the manifest file's original landing zone configuration is changed during the reset process, by default. This API is not the same as a rollback of a landing zone version, which is not a supported operation.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

get_landing_zone

Returns details about the landing zone. Displays a message in case of error.

SELECT
arn,
drift_status,
latest_available_version,
manifest,
remediation_types,
status,
version
FROM aws.controltower.landing_zones
WHERE region = '{{ region }}' -- required
;

list_landing_zones

Returns the landing zone ARN for the landing zone deployed in your managed account. This API also creates an ARN for existing accounts that do not yet have a landing zone ARN. Returns one landing zone ARN.

SELECT
arn
FROM aws.controltower.landing_zones
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_landing_zone

Creates a new landing zone. This API call starts an asynchronous operation that creates and configures a landing zone, based on the parameters specified in the manifest JSON file.

INSERT INTO aws.controltower.landing_zones (
version,
remediationTypes,
tags,
manifest,
region
)
SELECT 
'{{ version }}' /* required */,
'{{ remediationTypes }}',
'{{ tags }}',
'{{ manifest }}',
'{{ region }}'
RETURNING
arn,
operation_identifier
;

Manifest

# Description fields are for documentation purposes
- name: landing_zones
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the landing_zones resource.
  - name: version
    value: "{{ version }}"
  - name: remediationTypes
    value:
      - "{{ remediationTypes }}"
  - name: tags
    value: "{{ tags }}"
  - name: manifest
    value: "{{ manifest }}"

UPDATE examples

update_landing_zone

This API call updates the landing zone. It starts an asynchronous operation that updates the landing zone based on the new landing zone version, or on the changed parameters specified in the updated manifest file.

UPDATE aws.controltower.landing_zones
SET 
version = '{{ version }}',
remediationTypes = '{{ remediationTypes }}',
landingZoneIdentifier = '{{ landingZoneIdentifier }}',
manifest = '{{ manifest }}'
WHERE 
region = '{{ region }}' --required
AND version = '{{ version }}' --required
AND landingZoneIdentifier = '{{ landingZoneIdentifier }}' --required
RETURNING
operation_identifier;

DELETE examples

delete_landing_zone

Decommissions a landing zone. This API call starts an asynchronous operation that deletes Amazon Web Services Control Tower resources deployed in accounts managed by Amazon Web Services Control Tower. Decommissioning a landing zone is a process with significant consequences, and it cannot be undone. We strongly recommend that you perform this decommissioning process only if you intend to stop using your landing zone.

DELETE FROM aws.controltower.landing_zones
WHERE region = '{{ region }}' --required
;

Lifecycle Methods

reset_landing_zone

This API call resets a landing zone. It starts an asynchronous operation that resets the landing zone to the parameters specified in the original configuration, which you specified in the manifest file. Nothing in the manifest file's original landing zone configuration is changed during the reset process, by default. This API is not the same as a rollback of a landing zone version, which is not a supported operation.

EXEC aws.controltower.landing_zones.reset_landing_zone 
@region='{{ region }}' --required 
@@json=
'{
"landingZoneIdentifier": "{{ landingZoneIdentifier }}"
}'
;