Interface IControlTowerControlConfig

IGlobalConfig / IControlTowerConfig / IControlTowerControlConfig

Description

Control Tower controls

See

ControlTowerControlConfig

This allows you to enable Strongly Recommended or Elective Controls https://docs.aws.amazon.com/controltower/latest/userguide/optional-controls.html

Remarks

AWS Control Tower is limited to 10 concurrent operations, where enabling a control for one Organizational Unit constitutes a single operation. To avoid throttling, please enable controls in batches of 10 or fewer each pipeline run. Keep in mind other Control Tower operations may use up some of the available quota.

Not all controls can be deployed to Security OU. Please see this page for more information: https://docs.aws.amazon.com/controltower/latest/controlreference/exception-to-controls-security-ou.html.

Example

controlTowerControls:
  - identifier: AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS
    enable: true
    deploymentTargets:
      organizationalUnits:
        - Workloads
  - identifier: m7a5gbdf08wg2o0en010mkng
    enable: true
    deploymentTargets:
      organizationalUnits:
        - Infrastructure
interface IControlTowerControlConfig {
    deploymentTargets: IDeploymentTargets;
    enable: boolean;
    identifier: string;
    regions?: (
        | "af-south-1"
        | "ap-east-1"
        | "ap-east-2"
        | "ap-northeast-1"
        | "ap-northeast-2"
        | "ap-northeast-3"
        | "ap-south-1"
        | "ap-south-2"
        | "ap-southeast-1"
        | "ap-southeast-2"
        | "ap-southeast-3"
        | "ap-southeast-4"
        | "ap-southeast-5"
        | "ap-southeast-7"
        | "ca-central-1"
        | "ca-west-1"
        | "cn-north-1"
        | "cn-northwest-1"
        | "eu-central-1"
        | "eu-central-2"
        | "eu-north-1"
        | "eu-south-1"
        | "eu-south-2"
        | "eu-west-1"
        | "eu-west-2"
        | "eu-west-3"
        | "eu-isoe-west-1"
        | "il-central-1"
        | "me-central-1"
        | "me-south-1"
        | "mx-central-1"
        | "sa-east-1"
        | "us-east-1"
        | "us-east-2"
        | "us-gov-west-1"
        | "us-gov-east-1"
        | "us-iso-east-1"
        | "us-isob-east-1"
        | "us-iso-west-1"
        | "us-isof-south-1"
        | "us-isof-east-1"
        | "us-west-1"
        | "us-west-2")[];
}

Properties

deploymentTargets enable identifier regions?

Properties

ReadonlydeploymentTargets

deploymentTargets: IDeploymentTargets

Control Tower control deployment targets, controls can only be deployed to Organizational Units

Readonlyenable

enable: boolean

Control enabled

Readonlyidentifier

identifier: string

Control Tower control identifier. For Strongly Recommended or Elective controls this should start with AWS-GR. For Global Control Tower Controls, this should be the CONTROL_TOWER_OPAQUE_ID, please see this page for more information: https://docs.aws.amazon.com/controltower/latest/controlreference/all-global-identifiers.html.

Optional Readonlyregions

regions?: (
    | "af-south-1"
    | "ap-east-1"
    | "ap-east-2"
    | "ap-northeast-1"
    | "ap-northeast-2"
    | "ap-northeast-3"
    | "ap-south-1"
    | "ap-south-2"
    | "ap-southeast-1"
    | "ap-southeast-2"
    | "ap-southeast-3"
    | "ap-southeast-4"
    | "ap-southeast-5"
    | "ap-southeast-7"
    | "ca-central-1"
    | "ca-west-1"
    | "cn-north-1"
    | "cn-northwest-1"
    | "eu-central-1"
    | "eu-central-2"
    | "eu-north-1"
    | "eu-south-1"
    | "eu-south-2"
    | "eu-west-1"
    | "eu-west-2"
    | "eu-west-3"
    | "eu-isoe-west-1"
    | "il-central-1"
    | "me-central-1"
    | "me-south-1"
    | "mx-central-1"
    | "sa-east-1"
    | "us-east-1"
    | "us-east-2"
    | "us-gov-west-1"
    | "us-gov-east-1"
    | "us-iso-east-1"
    | "us-isob-east-1"
    | "us-iso-west-1"
    | "us-isof-south-1"
    | "us-isof-east-1"
    | "us-west-1"
    | "us-west-2")[]

(Optional) Region(s) where this service quota increase will be requested. Service Quota increases will be requested in the home region only if this property is not defined. If this property is defined, the regions must also be listed in the enabledRegions section or the change will not be applied.

Settings

Member Visibility

On This Page

Properties