AWS::ControlTower::EnabledControl

The resource represents an enabled control. It specifies an asynchronous operation that creates AWS resources on the specified organizational unit and the accounts it contains. The resources created will vary according to the control that you specify.

Syntax

To declare this entity in your AWS CloudFormation template, use the following syntax:

JSON

{
  "Type" : "AWS::ControlTower::EnabledControl",
  "Properties" : {
      "ControlIdentifier" : String,
      "Parameters" : [ EnabledControlParameter, ... ],
      "Tags" : [ Tag, ... ],
      "TargetIdentifier" : String
    }
}

YAML

Type: AWS::ControlTower::EnabledControl
Properties:
  ControlIdentifier: String
  Parameters: 
    - EnabledControlParameter
  Tags: 
    - Tag
  TargetIdentifier: String

Properties

ControlIdentifier

The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny control. For information on how to find the controlIdentifier, see the overview page.

Required: Yes

Type: String

Pattern: ^arn:aws[0-9a-zA-Z_\-:\/]+$

Minimum: 20

Maximum: 2048

Update requires: Replacement

Parameters

Array of EnabledControlParameter objects.

Required: No

Type: Array of EnabledControlParameter

Minimum: 1

Update requires: No interruption

Tags

Tags to be applied to the enabled control.

Required: No

Type: Array of Tag

Minimum: 1

Maximum: 50

Update requires: No interruption

TargetIdentifier

The ARN of the organizational unit. For information on how to find the targetIdentifier, see the overview page.

Required: Yes

Type: String

Pattern: ^arn:aws[0-9a-zA-Z_\-:\/]+$

Minimum: 20

Maximum: 2048

Update requires: Replacement

Return values

Ref

When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the physical ID of the resource. The format is of the form target | control. For example:

arn:aws:organizations::123456789012:ou/o-myorg/ou-my-ouid | arn:aws:controltower:us-west-2::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED

For more information about using the Ref function, see Ref.

Examples

Example

The following example creates an enabled control named MyExampleControl for an OU named ou-zzxx-zzx0zzz2.

JSON

{
    "Resources": {
        "MyExampleControl": {
            "Properties": {
                "ControlIdentifier": "arn:aws:controltower:us-east-2::control/EXAMPLE_NAME",
                 "TargetIdentifier": "arn:aws:organizations::01234567890:ou/o-EXAMPLE/ou-zzxx-zzx0zzz2"
            },
            "Type": "AWS::ControlTower::EnabledControl"
        }
    }
}

YAML

Resources:
  MyExampleControl:
    Properties:
      ControlIdentifier: 'arn:aws:controltower:us-east-2::control/EXAMPLE_NAME'
      TargetIdentifier: 'arn:aws:organizations::01234567890:ou/o-EXAMPLE/ou-zzxx-zzx0zzz2'
    Type: 'AWS::ControlTower::EnabledControl'