DisableBaseline EnableBaseline GetBaseline GetBaselineOperation GetEnabledBaseline ListBaselines ListEnabledBaselines ResetEnabledBaseline UpdateEnabledBaseline

Contoh penggunaan API dasar

Bagian ini berisi contoh parameter input dan output untuk API dasar AWS Control Tower.

`DisableBaseline`

Untuk informasi selengkapnya tentang operasi API ini, lihat DisableBaseline.

DisableBaselinemasukan:


{
    "enabledBaselineIdentifier": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/AB12CD34EF56GH789"
}

DisableBaselinekeluaran:


{
    "operationIdentifier": "58f12232-26be-4735-a3e9-dd30d90f021f"
}

DisableBaselineContoh CLI:


aws controltower disable-baseline \
    --enabled-baseline-identifier arn:aws:controltower:us-west-2:123456789012:enabledbaseline/AB12CD34EF56GH789 \
    --region us-west-2

`EnableBaseline`

Untuk informasi selengkapnya tentang operasi API ini, lihat EnableBaseline.

EnableBaselinemasukan:


{
    "baselineIdentifier": "arn:aws:controltower:us-west-2::baseline:17BSJV3IGJ2QSGA2",
    "targetIdentifier": "arn:aws:organizations::123456789012:ou/o-kgj0txdhpa/ou-r9mj-4j3mzjql",
    "baselineVersion": "3.0",
    "parameters": [
        {
            "key": "IdentityCenterEnabledBaselineArn",
            "value": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHCR4CJTSI4W07MZ"
        }
    ]
}

EnableBaselineoutput, mengembalikan sumber daya baru:


{
    "operationIdentifier": "58f12232-26be-4735-a3e9-dd30d90f021f",
    "arn": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAGF7TNOHRD7ES5VV"
}

EnableBaselineContoh CLI:

Contoh ini menunjukkan mengaktifkan baseline untuk AWS Organizations organisasi yang memiliki zona pendaratan yang diikutsertakan untuk akses Pusat Identi AWS tas IAM, yang dikelola oleh AWS Control Tower. Untuk mengambil pengi EnabledBaseline dentifikasi Pusat Identitas Anda, Anda dapat memang ListEnabledBaselines gil API, memfilter pada baseline Identity Center: (arn:aws:controltower:Region::baseline/LN25R72TTG6IGPTQ)


aws controltower list-enabled-baselines \
    --filter baselineIdentifiers=arn:aws:controltower:us-west-2::baseline/LN25R72TTG6IGPTQ \
    --region us-west-2

Respons akan menunjukkan EnabledBaseline detail, yang menunjukkan pengenalnya.


{
    "enabledBaselines": [
        {
            "arn": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHXS7P6C4I453EZC",
            "baselineIdentifier": "arn:aws:controltower:us-west-2::baseline/LN25R72TTG6IGPTQ",
            "targetIdentifier": "arn:aws:organizations::123456789012:account/o-aq21sw43de5/123456789012",
            "statusSummary": {
                "status": "SUCCEEDED"
            }
        }
    ]
}

catatan

Catat nilai ARN dari respons, dan berikan nilai ini sebagai parameter untuk mengaktifkan baseline default.


aws controltower enable-baseline \
    --baseline-identifier arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2 \
    --baseline-version 3.0 \
    --target-identifier arn:aws:organizations::123456789012:ou/o-aq21sw43de5/ou-po90-lk87jh65 \
    --parameters '[{"key":"IdentityCenterEnabledBaselineArn","value":"arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHXS7P6C4I453EZC"}]' \
    --region us-west-2

Untuk organisasi dengan zona pendaratan memilih keluar dari manajemen AWS Control Tower dari IAM Identity Center, aktifkan baseline tanpa parameter.


aws controltower enable-baseline \
    --baseline-identifier arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2 \
    --baseline-version 3.0 \
    --target-identifier arn:aws:organizations::123456789012:ou/o-aq21sw43de5/ou-po90-lk87jh65 \
    --region us-west-2

`GetBaseline`

Untuk informasi selengkapnya tentang operasi API ini, lihat GetBaseline.

GetBaselinemasukan:


{
    "baselineIdentifier": "arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2"
}

GetBaselinekeluaran:


{
    "arn": "arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2",
    "name": "AWSControlTowerBaseline",
    "description": "Sets up resources and mandatory controls for member accounts within the target OU, required for AWS Control Tower governance.",
}

GetBaselineContoh CLI:


aws controltower get-baseline \
    --baseline-identifier arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2 \
    --region us-west-2

`GetBaselineOperation`

Untuk informasi selengkapnya tentang operasi API ini, lihat GetBaselineOperation.

GetBaselineOperationmasukan:


{
    "operationIdentifier": "58f12232-26be-4735-a3e9-dd30d90f021f"
}

GetBaselineOperationkeluaran:


{
    "baselineOperation": {
        "operationIdentifier": "58f12232-26be-4735-a3e9-dd30d90f021f",
        "operationType": "DISABLE_BASELINE",
        "status": "FAILED",
        "startTime": "2023-01-12T19:05:00Z",
        "endTime": "2023-01-12T19:45:00Z",
        "statusMessage": "Can't perform DisableBaseline on a parent target with governed child OUs"
    }
}

GetBaselineOperationContoh CLI:


aws controltower get-baseline-operation \
    --operation-identifier 58f12232-26be-4735-a3e9-dd30d90f021f \
    --region us-west-2

`GetEnabledBaseline`

Untuk informasi selengkapnya tentang operasi API ini, lihat GetEnabledBaseline.

GetEnabledBaselinemasukan:


{
    "enabledBaselineIdentifier": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHCR4CJTSI4W07MZ"
}

GetEnabledBaselinekeluaran:


{
    "enabledBaselineDetails": {
        "arn": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHCR4CJTSI4W07MZ",
        "baselineIdentifier": "arn:aws:controltower:us-west-2::baseline:17BSJV3IGJ2QSGA2",
        "baselineVersion": "3.0",
        "targetIdentifier": "arn:aws:organizations::123456789012:ou/o-kgj0txdhpa/ou-r9mj-4j3mzjql",
        "statusSummary": {
            "status": "SUCCEEDED",
            "lastOperationIdentifier": "58f12232-26be-4735-a3e9-dd30d90f021f"
        },
        "parameters": [
            {
                "key": "IdentityCenterEnabledBaselineArn",
                "value": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHCR4CJTSI4W07MZ"
            }
        ]
    }
}

GetEnabledBaselineContoh CLI:


aws controltower get-enabled-baseline \
    --enabled-baseline-identifier arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHXS7P6C4I453EZC \
    --region us-west-2

`ListBaselines`

Untuk informasi selengkapnya tentang operasi API ini, lihat ListBaselines.

ListBaselinesmasukan (menggunakan input opsional):


{
    "nextToken": "AbCd1234",
    "maxResults": "4"
}

ListBaselineskeluaran:


{
    "baselines": [
        {
            "arn": "arn:aws:controltower:us-east-1::baseline/4T4HA1KMO10S6311",
            "name": "AuditBaseline",
            "description": "Sets up resources to monitor security and compliance of accounts in your organization."
        },
        {
            "arn": "arn:aws:controltower:us-east-1::baseline/J8HX46AHS5MIKQPD",
            "name": "LogArchiveBaseline",
            "description": "Sets up a central repository for logs of API activities and resource configurations from accounts in your organization."
        },
        {
            "arn": "arn:aws:controltower:us-east-1::baseline/LN25R72TTG6IGPTQ",
            "name": "IdentityCenterBaseline",
            "description": "Sets up shared resources for AWS Identity Center, which prepares the AWSControlTowerBaseline to set up Identity Center access for accounts."
        },
        {
            "arn": "arn:aws:controltower:us-east-1::baseline/17BSJV3IGJ2QSGA2",
            "name": "AWSControlTowerBaseline",
            "description": "Sets up resources and mandatory controls for member accounts within the target OU, required for AWS Control Tower governance."
        },
        {
            "arn": "arn:aws:controltower:us-east-1::baseline/3WPD0NA6TJ9AOMU2",
            "name": "BackupCentralVaultBaseline",
            "description": "Sets up central AWS Backup vault in your organization."
        },
        {
            "arn": "arn:aws:controltower:us-east-1::baseline/H6C5JFCJJ3CPU3J5",
            "name": "BackupManagerBaseline",
            "description": "Sets up delegated admin and AWS Backup Audit Manager."
        },
        {
            "arn": "arn:aws:controltower:us-east-1::baseline/APO9ATVPBKFRRGLK",
            "name": "BackupBaseline",
            "description": "Sets up local Backup vault and attach Backup policy."
        }
    ]
}

ListBaselinesContoh CLI:


aws controltower list-baselines \
    --region us-west-2

`ListEnabledBaselines`

ListEnabledBaselinesAPI memiliki parameter opsional yang memungkinkan Anda untuk melihat garis dasar yang berlaku untuk akun yang merupakan anggota OU. Contoh berikut menunjukkan beberapa perintah CLI yang dapat Anda gunakan untuk melihat garis dasar untuk akun. AWS Control Tower mengacu pada garis dasar ini, yang diaktifkan pada OU, tetapi berlaku untuk setiap akun di dalam OU, sebagai garis dasar yang diaktifkan anak, karena mereka memperoleh konfigurasi tata kelola mereka dari garis dasar yang diterapkan pada OU.

Untuk informasi selengkapnya tentang operasi API ini, lihat ListEnabledBaselines.

ListEnabledBaselinesmasukan untuk menampilkan garis dasar yang diaktifkan anak:


aws controltower list-enabled-baselines --include-children

ListEnabledBaselinesoutput untuk melihat garis dasar yang diaktifkan anak:


{
    "enabledBaselines": [
        {
            "arn": "arn:aws:controltower:us-east-1:666355521292:enabledbaseline/XO2UQ1PC6BB5085S5",
            "baselineIdentifier": "arn:aws:controltower:us-east-1::baseline/APO9ATVPBKFRRGLK",
            "baselineVersion": "1.0",
            "statusSummary": {
                "lastOperationIdentifier": "07d6d2b8-e357-4f96-ba00-98ea88143445",
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::666355521292:ou/o-vaex10vaey/ou-k86y-ld9k8vpu"
        },
        {
            "arn": "arn:aws:controltower:us-east-1:666355521292:enabledbaseline/XAFPKQQXOJB50ZWQH",
            "baselineIdentifier": "arn:aws:controltower:us-east-1::baseline/APO9ATVPBKFRRGLK",
            "baselineVersion": "1.0",
            "parentIdentifier": "arn:aws:controltower:us-east-1:666355521292:enabledbaseline/XOIZ4G08CWB50ZWON",
            "statusSummary": {
                "lastOperationIdentifier": "3508793e-48c8-4895-965b-3dc6abd52b6b",
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::666355521292:account/o-vaex10vaey/183295447314"
        }
]

catatan

Pada contoh sebelumnya, parentIdentifier bidang menunjukkan garis dasar yang diaktifkan dari OU induk untuk baseline yang diaktifkan turunan ini.

Lihat semua garis dasar yang diterapkan pada target tertentu (OU atau akun):


aws controltower list-enabled-baselines \
    --filter '{
        "targetIdentifiers": ["TARGET_ARN"]
    }

Lihat semua OU yang memiliki baseline tertentu:


aws controltower list-enabled-baselines \
    --filter '{
        "baselineIdentifiers": ["BASELINE_ARN"]
    }'

Lihat semua OU dan akun yang memiliki baseline tertentu:


aws controltower list-enabled-baselines \
    --filter '{
        "baselineIdentifiers": ["BASELINE_ARN"]
    }'  \
    --include-children

Lihat semua akun di OU yang mengaktifkan Baseline B:


### First fetch the enabled baseline record for Baseline B on the OU
 aws controltower list-enabled-baselines \
    --filter '{
        "targetIdentifiers": ["OU_TARGET_ARN"],
        "baselineIdentifiers": ["BASELINE_ARN_FOR_BASELINE_B"]
    }'
    
### Call ListEnabled baseline to fetch all accounts that have their parent as the enabled baseline record on the OU
aws controltower list-enabled-baselines \
    --filter '{
        "parentIdentifiers": ["ENABLED_BASELINE_ARN_FOR_OU"]
    }' \
    --include-children

Selengkapnya tentang garis dasar yang diaktifkan anak

Anda dapat menggunakan GetEnabledBaseline API untuk melihat informasi terperinci tentang baseline yang diaktifkan anak tertentu
Anda dapat menggunakan GetBaselineOperation API untuk melihat operasi yang dilakukan pada baseline yang diaktifkan anak
Anda tidak dapat memanggil API tulis apa pun, sepertiEnableBaseline,UpdateEnabledBaseline, ResetEnabledBaseline atauDisableBaseline, pada baseline turunan yang diaktifkan secara langsung.
Sumber daya dasar yang diaktifkan anak dapat dimodifikasi hanya melalui layanan AWS Control Tower, melalui operasi yang dilakukan pada OU induk, atau melalui Account Factory.

Contoh untuk menggunakan filter:

ListEnabledBaselinesmasukan (tidak ada filter):


{
    "nextToken": "bde7-XX0c6fXXXXXX",
    "maxResults": 5
}

ListEnabledBaselinesmasukan (hanya baselineIdentifiers filter):


{
    "filter": {
        "baselineIdentifiers": ['arn:aws:controltower:us-east-1::baseline/17BSJV3IGJ2QSGA2', 'arn:aws:controltower:us-east-1::baseline/12GZU8CKZKVMS2AW']
    },
    "nextToken": "bde7-XX0c6fXXXXXX",
    "maxResults": 5
}

ListEnabledBaselinesmasukan (hanya targetIdentifiers filter):


{
    "filter": {
        "targetIdentifiers": ['arn:aws:organizations::123456789012:ou/o-s9511vn103/ou-xqj7-fex1u317', 'arn:aws:organizations::123456789012:ou/o-s9511vn103/ou-xqj7-11q6n2cf']
    },
    "nextToken": "bde7-XX0c6fXXXXXX",
    "maxResults": 2
}

ListEnabledBaselinesinput (baselineIdentifiersdan targetIdentifiers filter):


{
    "filter": {
        "baselineIdentifiers": ['arn:aws:controltower:us-east-1::baseline/17BSJV3IGJ2QSGA2']
        "targetIdentifiers": ['arn:aws:organizations::123456789012:ou/o-s9511vn103/ou-xqj7-fex1u317']
    },
    "nextToken": "bde7-XX0c6fXXXXXX",
    "maxResults": 5
}

ListEnabledBaselineskeluaran:


{
    "enabledBaselines": [
        {
            "arn": "arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XAHCR4CJTSI4W07MZ",
            "baselineIdentifier": "arn:aws:controltower:us-east-1::baseline:17BSJV3IGJ2QSGA2",
            "baselineVersion": "3.0",
            "targetIdentifier": "arn:aws:organizations::123456789012:ou/o-kgj0txdhpa/ou-r9mj-4j3mzjql",
            "statusSummary": {
                "status": "SUCCEEDED",
                "lastOperationIdentifier": "58f12232-26be-4735-a3e9-dd30d90f021f"
            }
        },
        {
            "arn": "arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XAJ9NKW88AA4W9CLL",
            "baselineIdentifier": "arn:aws:controltower:us-east-1::baseline:17BSJV3IGJ2QSGA2",
            "baselineVersion": "4.0",
            "targetIdentifier": "arn:aws:organizations::123456789012:ou/o-s9511vn103/ou-xqj7-fex1u317",
            "statusSummary": {
            "status": "FAILED",
                "lastOperationIdentifier": "81e02df1-2b4d-48f0-838f-3833b93dcdc0"
            }
        }
    ],
    "nextToken": "e2bXXXXX6cab"
}

Contoh CLI dengan satu jenis filter (baselineIdentifiersfilter):


aws controltower list-enabled-baselines \
    --filter baselineIdentifiers=arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2,arn:aws:controltower:us-west-2::baseline/LN25R72TTG6IGPTQ \
    --region us-west-2

Contoh CLI menggunakan beberapa filter (baselineIdentifiersdan targetIdentifiers filter):


aws controltower list-enabled-baselines \
    --filter targetIdentifiers=arn:aws:organizations::123456789012:ou/o-aq21sw43de5/ou-po90-lk87jh65,baselineIdentifiers=arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2 \
    --region us-west-2

`ResetEnabledBaseline`

Untuk informasi selengkapnya tentang operasi API ini, lihat ResetEnabledBaseline.

ResetEnabledbaselinemasukan:


{
    "enabledBaselineIdentifier": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAJ9NKW88AA4W9CLL"
}

ResetEnabledBaselinekeluaran:


{
    "operationIdentifier": "81e02df1-2b4d-48f0-838f-3833b93dcdc0"
}

ResetEnabledBaselineContoh CLI:


aws controltower reset-enabled-baseline \
    --enabled-baseline-identifier arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHXS7P6C4I453EZC \
    --region us-west-2

`UpdateEnabledBaseline`

Untuk informasi selengkapnya tentang operasi API ini, lihat UpdateEnabledBaseline.

UpdateEnabledBaselinemasukan:


{
    "enabledBaselineIdentifier": "arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XAJ9NKW88AA4W9CLL",
    "baselineVersion": "4.0",
    "parameters": [
        {
            "key": "IdentityCenterEnabledBaselineArn",
            "value": "arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XAHCR4CJTSI4W07MZ"
        }
    ] 
}

UpdateEnabledBaselinekeluaran:


{
    "operationIdentifier": "81e02df1-2b4d-48f0-838f-3833b93dcdc0"
}

UpdateEnabledBaselineContoh CLI:


aws controltower update-enabled-baseline \
    --enabled-baseline-identifier arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHXS7P6C4I453EZC \
    --baseline-version 4.0
    --parameters '[{"key":"IdentityCenterEnabledBaselineArn","value":"arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHXS7P6C4I453EZC"}]' \
    --region us-west-2

Awas Javascript dinonaktifkan atau tidak tersedia di browser Anda.

Untuk menggunakan Dokumentasi AWS, Javascript harus diaktifkan. Lihat halaman Bantuan browser Anda untuk petunjuk.

Konvensi Dokumen

Contoh: Mendaftarkan OU AWS Control Tower dengan API saja

Informasi tambahan