[アップデート] AWS Control Tower に新しい API として GetEnabledControl が追加されました

[アップデート] AWS Control Tower に新しい API として GetEnabledControl が追加されました

AWS Control Tower に新しい API として「GetEnabledControl」が追加されました。
#AWS Control Tower
#AWS CLI
#AWS
yhana

yhana

facebook logohatena logotwitter logo
Clock Icon2023.10.28

この記事は公開されてから1年以上経過しています。情報が古い可能性がありますので、ご注意ください。

AWS Control Tower の新しい API として「GetEnabledControl」が追加されました。有効化しているコントロールに関する情報を取得できます。本ブログでは、「GetEnabledControl」に対応する AWS CLI コマンドを試してみました。


GetEnabledControl の API 説明ページは下記です。

対応する AWS CLI のコマンドであるget-enabled-controlのリファレンスは下記ページです。

また、ユーザーガイドにも API の利用例が追加されています。2023.10.14 にドキュメントが更新されており、執筆時点で英語版のみです。

AWS CLI で試してみた

AWS CLI で AWS Control Tower のget-enabled-controlコマンドを試してみます。

AWS Control Tower が有効化されている管理アカウントの AWS CloudShell から実行してみます。AWS Control Tower のホームリージョンを利用します。


get-enabled-controlコマンドの必須オプションとして有効化されているコントロールの ARN の指定が必要なため、まずは既存のリストコマンドであるlist-enabled-controlsを実行して有効なコントロールの ARN を確認します。

実行コマンドです。target-identifierとして対象とする OU を指定します。

aws controltower list-enabled-controls --target-identifier arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example

実行結果です。

$ aws controltower list-enabled-controls --target-identifier arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example{
    "enabledControls": [
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/B1686UIOETVAUKHE",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_AUDIT_BUCKET_DELETION_PROHIBITED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/67ER3UOD7TALRJXK",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_READ_PROHIBITED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/67ER3UWETCFTTGQ5",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_AUDIT_BUCKET_PUBLIC_WRITE_PROHIBITED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/1DNA0UV4O9FLG9RD",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/67ER3V4KOXORO5EF",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/1DNA0UWWNJDYBOB1",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_CLOUDTRAIL_ENABLED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/RXCDZFFL18S1CFMB",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_CLOUDTRAIL_VALIDATION_ENABLED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/67ER3VCC6AHZE9TL",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_CLOUDWATCH_EVENTS_CHANGE_PROHIBITED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/RXCDZF712D8SANAC",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_CONFIG_AGGREGATION_AUTHORIZATION_POLICY",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/B1686W3KU1GWZ0JG",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_CONFIG_AGGREGATION_CHANGE_PROHIBITED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/1DNA0V0GWULMKSI9",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_CONFIG_CHANGE_PROHIBITED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/B1686WHSRMFPWMZR",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_CONFIG_ENABLED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/67ER3VSNJJGOGRKN",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_CONFIG_RULE_CHANGE_PROHIBITED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/1DNA0V401WT2QFIW",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_CT_AUDIT_BUCKET_ENCRYPTION_CHANGES_PROHIBITED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/B1686WW0JIS2KK6D",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_CT_AUDIT_BUCKET_LIFECYCLE_CONFIGURATION_CHANGES_PROHIBITED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/RXCDZIDEIEFS2E7W",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_CT_AUDIT_BUCKET_LOGGING_CONFIGURATION_CHANGES_PROHIBITED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/RXCDZJ3EUYO0ICPK",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_CT_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/B1686XA8COLOW4XQ",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_SHARED_ACCOUNTS",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/J9JSXQESG5K8Y8W1",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "lastOperationIdentifier": "e7d555af-666a-45a0-944b-a897f1a1909c",
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/RXCDZK9DQLPNNWF9",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_IAM_ROLE_CHANGE_PROHIBITED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/RXCDZK5RG472JUD0",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_LAMBDA_CHANGE_PROHIBITED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/67ER3WOIQW0TEYWM",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_LOG_GROUP_POLICY",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/8K88BUHIWWD8GZ2F",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_REGION_DENY",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/67ER3WOOFHRGRDRS",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_SNS_CHANGE_PROHIBITED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        },
        {
            "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/1DNA0VB4HECC93C4",
            "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_SNS_SUBSCRIPTION_CHANGE_PROHIBITED",
            "driftStatusSummary": {
                "driftStatus": "NOT_CHECKING"
            },
            "statusSummary": {
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example"
        }
    ]
}


リストの中から検出タイプのコントロールであるAWS-GR_EC2_INSTANCE_NO_PUBLIC_IPを指定してget-enabled-controlコマンドを実行してみます。

実行コマンドです。enabled-control-identifierオプションにはコントロールの ARN を指定します。controlIdentifierではないため注意が必要です。

aws controltower get-enabled-control --enabled-control-identifier arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/J9JSXQESG5K8Y8W1

実行結果です。

$ aws controltower get-enabled-control --enabled-control-identifier arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/J9JSXQESG5K8Y8W1
{
    "enabledControlDetails": {
        "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/J9JSXQESG5K8Y8W1",
        "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP",
        "driftStatusSummary": {
            "driftStatus": "NOT_CHECKING"
        },
        "statusSummary": {
            "lastOperationIdentifier": "e7d555af-666a-45a0-944b-a897f1a1909c",
            "status": "SUCCEEDED"
        },
        "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example",
        "targetRegions": [
            {
                "name": "ap-northeast-1"
            },
            {
                "name": "us-east-1"
            },
            {
                "name": "us-west-2"
            }
        ]
    }
}


list-enabled-controlsコマンドとして比較してtargetRegionsが追加されています。

targetRegionsには有効なコントールがデプロイできるリージョンが出力されており、検出タイプのコントロールの場合は AWS Control Tower のランディングゾーン設定におけるランディングゾーンリージョンと同様でした。上記の実行環境ではランディングゾーンリージョンとして次の 3 つのリージョンを指定しており、リージョン拒否コントロールを有効化しています。

  • バージニア北部リージョン
  • オレゴンリージョン
  • 東京リージョン

次に、予防のコントロールであるAWS-GR_CLOUDTRAIL_CHANGE_PROHIBITEDを確認してみます。

$ aws controltower get-enabled-control --enabled-control-identifier arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/1DNA0UV4O9FLG9RD
{
    "enabledControlDetails": {
        "arn": "arn:aws:controltower:ap-northeast-1:111122223333:enabledcontrol/1DNA0UV4O9FLG9RD",
        "controlIdentifier": "arn:aws:controltower:ap-northeast-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED",
        "driftStatusSummary": {
            "driftStatus": "NOT_CHECKING"
        },
        "statusSummary": {
            "status": "SUCCEEDED"
        },
        "targetIdentifier": "arn:aws:organizations::111122223333:ou/o-xxxxxxxxxx/ou-noa1-4example",
        "targetRegions": [
            {
                "name": "ap-south-2"
            },
            {
                "name": "ap-south-1"
            },
            {
                "name": "eu-south-1"
            },
            {
                "name": "eu-south-2"
            },
            {
                "name": "me-central-1"
            },
            {
                "name": "il-central-1"
            },
            {
                "name": "ca-central-1"
            },
            {
                "name": "eu-central-1"
            },
            {
                "name": "eu-central-2"
            },
            {
                "name": "us-west-1"
            },
            {
                "name": "us-west-2"
            },
            {
                "name": "af-south-1"
            },
            {
                "name": "eu-north-1"
            },
            {
                "name": "eu-west-3"
            },
            {
                "name": "eu-west-2"
            },
            {
                "name": "eu-west-1"
            },
            {
                "name": "ap-northeast-3"
            },
            {
                "name": "ap-northeast-2"
            },
            {
                "name": "me-south-1"
            },
            {
                "name": "ap-northeast-1"
            },
            {
                "name": "sa-east-1"
            },
            {
                "name": "ap-east-1"
            },
            {
                "name": "ap-southeast-1"
            },
            {
                "name": "ap-southeast-2"
            },
            {
                "name": "ap-southeast-3"
            },
            {
                "name": "ap-southeast-4"
            },
            {
                "name": "us-east-1"
            },
            {
                "name": "us-east-2"
            }
        ]
    }
}

targetRegionsにはランディングゾーンリージョン以外のリージョンもあることが確認できます。


以上で AWS CLI でのお試しは終わりです。

さいごに

これまで AWS Control Tower の API は 4 種類でしたが、今回 GetEnabledControl が追加されて 5 種類になりました。

  • EnableControl
  • DisableControl
  • GetControlOperation
  • GetEnabledControl
  • ListEnabledControls

GetEnabledControl に対応する AWS CLI コマンドであるget-enabled-controlコマンドを試してみてターゲットリージョンが出力されることを確認しました。

このブログのどなたかのご参考になれば幸いです。

Share this article

facebook logohatena logotwitter logo

関連記事

[Tips] AWS Control Towerのコントロールが関連付けされたOUを簡単に削除する方法

[Tips] AWS Control Towerのコントロールが関連付けされたOUを簡単に削除する方法

User avatar
あしざわ
2024.09.30
Control Tower 管理 CloudTrail をオプトアウトして CloudWatch Logs コストを削減

Control Tower 管理 CloudTrail をオプトアウトして CloudWatch Logs コストを削減

User avatar
川原征大
2024.09.19
[アップデート] AWS Control TowerのOUに最大1000個のアカウントが含められるようになりました

[アップデート] AWS Control TowerのOUに最大1000個のアカウントが含められるようになりました

User avatar
武田隆志
2024.08.31
AWS Control Tower のコントロール一覧をCSV化してみる【AWS CLI】

AWS Control Tower のコントロール一覧をCSV化してみる【AWS CLI】

User avatar
川原征大
2024.08.13
Classmethod's white logo
Facebook's logo
X's logo
YouTube's logo

© Classmethod, Inc. All rights reserved.