第 2 步：启动您的着陆区

Cont AWS rol Tower CreateLandingZone API 需要一个着陆区域版本和一个清单文件作为输入参数。您可以使用清单文件配置以下功能：

• （可选）配置日志保留

• （可选）自行管理访问权限 AWS 账户

• （可选）配置 AWS CloudTrail 跟踪

• （可选）配置 AWS KMS keys

编译清单文件后，您就可以创建新的着陆区了。

注意

AWS使用APIs配置和启动着陆区时，Control Tower 不支持区域拒绝控制。使用成功启动着陆区后APIs，您可以使用 Cont AWS rol Tower 控制台配置区域拒绝控制。

1. 致电 Cont AWS rol Tower CreateLandingZone API。这API需要一个 landing zone 版本和清单文件作为输入。

   aws controltower create-landing-zone --landing-zone-version 3.3 --manifest "file://LandingZoneManifest.json"

   LandingZoneManifest.json 清单示例：

   {
      "governedRegions": ["us-west-2","us-west-1"],
      "organizationStructure": {
          "security": {
              "name": "CORE"
          },
          "sandbox": {
              "name": "Sandbox"
          }
      },
      "centralizedLogging": {
           "accountId": "222222222222",
           "configurations": {
               "loggingBucket": {
                   "retentionDays": 60
               },
               "accessLoggingBucket": {
                   "retentionDays": 60
               },
               "kmsKeyArn": "arn:aws:kms:us-west-1:123456789123:key/e84XXXXX-6bXX-49XX-9eXX-ecfXXXXXXXXX"
           },
           "enabled": true
      },
      "securityRoles": {
           "accountId": "333333333333"
      },
      "accessManagement": {
           "enabled": true
      }
   }

   注意

   如示例所示， CentralizedLogging 和 SecurityRoles 账户AccountId的必须不同。

   输出：

   {
      "arn": "arn:aws:controltower:us-west-2:123456789012:landingzone/1A2B3C4D5E6F7G8H",
      "operationIdentifier": "55XXXXXX-e2XX-41XX-a7XX-446XXXXXXXXX"
   }

2. GetLandingZoneOperationAPI致电查看CreateLandingZone操作状态。GetLandingZoneOperationAPI返回的状态为SUCCEEDEDFAILED、或IN_PROGRESS。

   aws controltower get-landing-zone-operation --operation-identifier "55XXXXXX-eXXX-4XXX-aXXX-44XXXXXXXXXX"

   输出：

   {
       "operationDetails": {
           "operationType": "CREATE",
           "startTime": "Thu Nov 09 20:39:19 UTC 2023",
           "endTime": "Thu Nov 09 21:02:01 UTC 2023",
           "status": "SUCCEEDED"
       }
   }

3. 当状态返回为时SUCCEEDED，您可以致电GetLandingZoneAPI查看着陆区配置。

   aws controltower get-landing-zone --landing-zone-identifier "arn:aws:controltower:us-west-2:123456789123:landingzone/1A2B3C4D5E6F7G8H"

   输出：

   {
       "landingZone": {
           "arn": "arn:aws:controltower:us-west-2:123456789012:landingzone/1A2B3C4D5E6F7G8H",
           "driftStatus": {
               "status": "IN_SYNC"
           },
           "latestAvailableVersion": "3.3",
           "manifest": {
               "accessManagement": {
                   "enabled": true
               },
               "securityRoles": {
                   "accountId": "333333333333"
               },
               "governedRegions": [
                   "us-west-1",
                   "eu-west-3",
                   "us-west-2"
               ],
               "organizationStructure": {
                   "sandbox": {
                       "name": "Sandbox"
                   },
                   "security": {
                       "name": "Security"
                   }
               },
               "centralizedLogging": {
                   "accountId": "222222222222",
                   "configurations": {
                       "loggingBucket": {
                           "retentionDays": 60
                       },
                       "kmsKeyArn": "arn:aws:kms:us-west-1:123456789123:key/e84XXXXX-6bXX-49XX-9eXX-ecfXXXXXXXXX",
                       "accessLoggingBucket": {
                           "retentionDays": 60
                       }
                   },
                   "enabled": true
               }
           },
           "status": "PROCESSING",
           "version": "3.3"
       }
   }