本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 基准 API 用法示例
<a name="baseline-api-examples"></a>

 本节包含 AWS Control Tower 基准的输入和输出参数示例 APIs。

## `DisableBaseline`
<a name="disable-baseline"></a>

有关此 API 操作的更多信息，请参阅[DisableBaseline](https://docs.aws.amazon.com//controltower/latest/APIReference/API_DisableBaseline.html)。

`DisableBaseline` 输入：

```
{
    "enabledBaselineIdentifier": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/AB12CD34EF56GH789"
}
```

`DisableBaseline` 输出：

```
{
    "operationIdentifier": "58f12232-26be-4735-a3e9-dd30d90f021f"
}
```

`DisableBaseline` CLI 示例：

```
aws controltower disable-baseline \
    --enabled-baseline-identifier arn:aws:controltower:us-west-2:123456789012:enabledbaseline/AB12CD34EF56GH789 \
    --region us-west-2
```

## `EnableBaseline`
<a name="enable-baseline"></a>

有关此 API 操作的更多信息，请参阅[EnableBaseline](https://docs.aws.amazon.com//controltower/latest/APIReference/API_EnableBaseline.html)。

`EnableBaseline` 输入：

```
{
    "baselineIdentifier": "arn:aws:controltower:us-west-2::baseline:17BSJV3IGJ2QSGA2",
    "targetIdentifier": "arn:aws:organizations::123456789012:ou/o-kgj0txdhpa/ou-r9mj-4j3mzjql",
    "baselineVersion": "3.0",
    "parameters": [
        {
            "key": "IdentityCenterEnabledBaselineArn",
            "value": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHCR4CJTSI4W07MZ"
        }
    ]
}
```

`EnableBaseline` 输出，返回一项新资源：

```
{
    "operationIdentifier": "58f12232-26be-4735-a3e9-dd30d90f021f",
    "arn": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAGF7TNOHRD7ES5VV"
}
```

`EnableBaseline` CLI 示例：

此示例演示如何为一个AWS Organizations组织启用基准，该着陆区已选择接入 AWS Control Tower 管理的 IA AWS M 身份中心访问权限。要检索您的 Identity Center `EnabledBaseline` 标识符，您可以调用 `ListEnabledBaselines` API，根据 Identity Center 基准进行筛选：`(arn:aws:controltower:Region::baseline/LN25R72TTG6IGPTQ)`

```
aws controltower list-enabled-baselines \
    --filter baselineIdentifiers=arn:aws:controltower:us-west-2::baseline/LN25R72TTG6IGPTQ \
    --region us-west-2
```

响应将显示 `EnabledBaseline` 详细信息，其中显示其标识符。

```
{
    "enabledBaselines": [
        {
            "arn": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHXS7P6C4I453EZC",
            "baselineIdentifier": "arn:aws:controltower:us-west-2::baseline/LN25R72TTG6IGPTQ",
            "targetIdentifier": "arn:aws:organizations::123456789012:account/o-aq21sw43de5/123456789012",
            "statusSummary": {
                "status": "SUCCEEDED"
            }
        }
    ]
}
```

**注意**  
记下响应中的 ARN 值，并将此值作为参数传递以启用默认基准。

```
aws controltower enable-baseline \
    --baseline-identifier arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2 \
    --baseline-version 3.0 \
    --target-identifier arn:aws:organizations::123456789012:ou/o-aq21sw43de5/ou-po90-lk87jh65 \
    --parameters '[{"key":"IdentityCenterEnabledBaselineArn","value":"arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHXS7P6C4I453EZC"}]' \
    --region us-west-2
```

如果组织具有已选择退出 IAM Identity Center 的 AWS Control Tower 管理的登录区，请启用不带该参数的基准。

```
aws controltower enable-baseline \
    --baseline-identifier arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2 \
    --baseline-version 3.0 \
    --target-identifier arn:aws:organizations::123456789012:ou/o-aq21sw43de5/ou-po90-lk87jh65 \
    --region us-west-2
```

## `GetBaseline`
<a name="get-baseline"></a>

有关此 API 操作的更多信息，请参阅[GetBaseline](https://docs.aws.amazon.com//controltower/latest/APIReference/API_GetBaseline.html)。

`GetBaseline` 输入：

```
{
    "baselineIdentifier": "arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2"
}
```

`GetBaseline` 输出：

```
{
    "arn": "arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2",
    "name": "AWSControlTowerBaseline",
    "description": "Sets up resources and mandatory controls for member accounts within the target OU, required for AWS Control Tower governance.",
}
```

`GetBaseline` CLI 示例：

```
aws controltower get-baseline \
    --baseline-identifier arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2 \
    --region us-west-2
```

## `GetBaselineOperation`
<a name="get-baseline-operation"></a>

有关此 API 操作的更多信息，请参阅[GetBaselineOperation](https://docs.aws.amazon.com//controltower/latest/APIReference/API_GetBaselineOperation.html)。

`GetBaselineOperation` 输入：

```
{
    "operationIdentifier": "58f12232-26be-4735-a3e9-dd30d90f021f"
}
```

`GetBaselineOperation` 输出：

```
{
    "baselineOperation": {
        "operationIdentifier": "58f12232-26be-4735-a3e9-dd30d90f021f",
        "operationType": "DISABLE_BASELINE",
        "status": "FAILED",
        "startTime": "2023-01-12T19:05:00Z",
        "endTime": "2023-01-12T19:45:00Z",
        "statusMessage": "Can't perform DisableBaseline on a parent target with governed child OUs"
    }
}
```

`GetBaselineOperation` CLI 示例：

```
aws controltower get-baseline-operation \
    --operation-identifier 58f12232-26be-4735-a3e9-dd30d90f021f \
    --region us-west-2
```

## `GetEnabledBaseline`
<a name="get-enabled-baseline"></a>

有关此 API 操作的更多信息，请参阅[GetEnabledBaseline](https://docs.aws.amazon.com//controltower/latest/APIReference/API_GetEnabledBaseline.html)。

`GetEnabledBaseline` 输入：

```
{
    "enabledBaselineIdentifier": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHCR4CJTSI4W07MZ"
}
```

`GetEnabledBaseline` 输出：

```
{
    "enabledBaselineDetails": {
        "arn": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHCR4CJTSI4W07MZ",
        "baselineIdentifier": "arn:aws:controltower:us-west-2::baseline:17BSJV3IGJ2QSGA2",
        "baselineVersion": "3.0",
        "targetIdentifier": "arn:aws:organizations::123456789012:ou/o-kgj0txdhpa/ou-r9mj-4j3mzjql",
        "statusSummary": {
            "status": "SUCCEEDED",
            "lastOperationIdentifier": "58f12232-26be-4735-a3e9-dd30d90f021f"
        },
        "parameters": [
            {
                "key": "IdentityCenterEnabledBaselineArn",
                "value": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHCR4CJTSI4W07MZ"
            }
        ]
    }
}
```

`GetEnabledBaseline` CLI 示例：

```
aws controltower get-enabled-baseline \
    --enabled-baseline-identifier arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHXS7P6C4I453EZC \
    --region us-west-2
```

## `ListBaselines`
<a name="list-baselines"></a>

有关此 API 操作的更多信息，请参阅[ListBaselines](https://docs.aws.amazon.com//controltower/latest/APIReference/API_ListBaselines.html)。

`ListBaselines` 输入（使用可选输入）：

```
{
    "nextToken": "AbCd1234",
    "maxResults": "4"
}
```

`ListBaselines` 输出：

```
{
    "baselines": [
        {
            "arn": "arn:aws:controltower:us-east-1::baseline/4T4HA1KMO10S6311",
            "name": "AuditBaseline",
            "description": "Sets up resources to monitor security and compliance of accounts in your organization."
        },
        {
            "arn": "arn:aws:controltower:us-east-1::baseline/J8HX46AHS5MIKQPD",
            "name": "LogArchiveBaseline",
            "description": "Sets up a central repository for logs of API activities and resource configurations from accounts in your organization."
        },
        {
            "arn": "arn:aws:controltower:us-east-1::baseline/LN25R72TTG6IGPTQ",
            "name": "IdentityCenterBaseline",
            "description": "Sets up shared resources for AWS Identity Center, which prepares the AWSControlTowerBaseline to set up Identity Center access for accounts."
        },
        {
            "arn": "arn:aws:controltower:us-east-1::baseline/17BSJV3IGJ2QSGA2",
            "name": "AWSControlTowerBaseline",
            "description": "Sets up resources and mandatory controls for member accounts within the target OU, required for AWS Control Tower governance."
        },
        {
            "arn": "arn:aws:controltower:us-east-1::baseline/3WPD0NA6TJ9AOMU2",
            "name": "BackupCentralVaultBaseline",
            "description": "Sets up central AWS Backup vault in your organization."
        },
        {
            "arn": "arn:aws:controltower:us-east-1::baseline/H6C5JFCJJ3CPU3J5",
            "name": "BackupManagerBaseline",
            "description": "Sets up delegated admin and AWS Backup Audit Manager."
        },
        {
            "arn": "arn:aws:controltower:us-east-1::baseline/APO9ATVPBKFRRGLK",
            "name": "BackupBaseline",
            "description": "Sets up local Backup vault and attach Backup policy."
        }
    ]
}
```

`ListBaselines` CLI 示例：

```
aws controltower list-baselines \
    --region us-west-2
```

## `ListEnabledBaselines`
<a name="list-enabled-baselines"></a>

`ListEnabledBaselines` API 提供一个可选参数，允许您查看适用于 OU 成员账户的基准。以下示例显示了一些 CLI 命令，您可以使用这些命令来查看账户的基准。AWS Control Tower 将这些基准称为*启用子项的基准*，这些基准在 OU 上启用，但应用于 OU 中的每个账户，因为它们的监管配置来自应用于 OU 的基准。

有关此 API 操作的更多信息，请参阅[ListEnabledBaselines](https://docs.aws.amazon.com//controltower/latest/APIReference/API_ListEnabledBaselines.html)。

用于显示启用子项的基准的 `ListEnabledBaselines` 输入：

```
aws controltower list-enabled-baselines --include-children
```

用于查看启用子项的基准的 `ListEnabledBaselines` 输出：

```
{
    "enabledBaselines": [
        {
            "arn": "arn:aws:controltower:us-east-1:666355521292:enabledbaseline/XO2UQ1PC6BB5085S5",
            "baselineIdentifier": "arn:aws:controltower:us-east-1::baseline/APO9ATVPBKFRRGLK",
            "baselineVersion": "1.0",
            "statusSummary": {
                "lastOperationIdentifier": "07d6d2b8-e357-4f96-ba00-98ea88143445",
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::666355521292:ou/o-vaex10vaey/ou-k86y-ld9k8vpu"
        },
        {
            "arn": "arn:aws:controltower:us-east-1:666355521292:enabledbaseline/XAFPKQQXOJB50ZWQH",
            "baselineIdentifier": "arn:aws:controltower:us-east-1::baseline/APO9ATVPBKFRRGLK",
            "baselineVersion": "1.0",
            "parentIdentifier": "arn:aws:controltower:us-east-1:666355521292:enabledbaseline/XOIZ4G08CWB50ZWON",
            "statusSummary": {
                "lastOperationIdentifier": "3508793e-48c8-4895-965b-3dc6abd52b6b",
                "status": "SUCCEEDED"
            },
            "targetIdentifier": "arn:aws:organizations::666355521292:account/o-vaex10vaey/183295447314"
        }
]
```

**注意**  
在前面的示例中，`parentIdentifier` 字段显示父 OU 为此启用子项的基准启用的基准。

查看应用于特定目标（OU 或账户）的所有基准：

```
aws controltower list-enabled-baselines \
    --filter '{
        "targetIdentifiers": ["TARGET_ARN"]
    }
```

查看所有 OUs 具有特定基准的内容：

```
aws controltower list-enabled-baselines \
    --filter '{
        "baselineIdentifiers": ["BASELINE_ARN"]
    }'
```

查看所有具有特定基准的账户 OUs 和账户：

```
aws controltower list-enabled-baselines \
    --filter '{
        "baselineIdentifiers": ["BASELINE_ARN"]
    }'  \
    --include-children
```

查看 OU 中所有启用了基准 B 的账户：

```
### First fetch the enabled baseline record for Baseline B on the OU
 aws controltower list-enabled-baselines \
    --filter '{
        "targetIdentifiers": ["OU_TARGET_ARN"],
        "baselineIdentifiers": ["BASELINE_ARN_FOR_BASELINE_B"]
    }'
    
### Call ListEnabled baseline to fetch all accounts that have their parent as the enabled baseline record on the OU
aws controltower list-enabled-baselines \
    --filter '{
        "parentIdentifiers": ["ENABLED_BASELINE_ARN_FOR_OU"]
    }' \
    --include-children
```

**有关启用子项的基准的更多信息**  
您可以使用 `GetEnabledBaseline` API 查看有关特定启用子项的基准的详细信息
您可以使用 `GetBaselineOperation` API 查看在启用子项的基准上执行的操作
在启用子项的基线上 `EnableBaseline``UpdateEnabledBaseline`，您不能直接调用任何写入 APIs，例如`DisableBaseline`、`ResetEnabledBaseline`或。
启用子项的基准资源只能通过 AWS Control Tower 服务、通过在父 OU 上执行的操作或通过 Account Factory 进行修改。

使用筛选的示例：

`ListEnabledBaselines` 输入（无筛选条件）：

```
{
    "nextToken": "bde7-XX0c6fXXXXXX",
    "maxResults": 5
}
```

`ListEnabledBaselines` 输入（仅限 `baselineIdentifiers` 筛选条件）：

```
{
    "filter": {
        "baselineIdentifiers": ['arn:aws:controltower:us-east-1::baseline/17BSJV3IGJ2QSGA2', 'arn:aws:controltower:us-east-1::baseline/12GZU8CKZKVMS2AW']
    },
    "nextToken": "bde7-XX0c6fXXXXXX",
    "maxResults": 5
}
```

`ListEnabledBaselines` 输入（仅限 `targetIdentifiers` 筛选条件）：

```
{
    "filter": {
        "targetIdentifiers": ['arn:aws:organizations::123456789012:ou/o-s9511vn103/ou-xqj7-fex1u317', 'arn:aws:organizations::123456789012:ou/o-s9511vn103/ou-xqj7-11q6n2cf']
    },
    "nextToken": "bde7-XX0c6fXXXXXX",
    "maxResults": 2
}
```

`ListEnabledBaselines` 输入（`baselineIdentifiers` 和 `targetIdentifiers` 筛选条件）：

```
{
    "filter": {
        "baselineIdentifiers": ['arn:aws:controltower:us-east-1::baseline/17BSJV3IGJ2QSGA2']
        "targetIdentifiers": ['arn:aws:organizations::123456789012:ou/o-s9511vn103/ou-xqj7-fex1u317']
    },
    "nextToken": "bde7-XX0c6fXXXXXX",
    "maxResults": 5
}
```

`ListEnabledBaselines` 输出：

```
{
    "enabledBaselines": [
        {
            "arn": "arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XAHCR4CJTSI4W07MZ",
            "baselineIdentifier": "arn:aws:controltower:us-east-1::baseline:17BSJV3IGJ2QSGA2",
            "baselineVersion": "3.0",
            "targetIdentifier": "arn:aws:organizations::123456789012:ou/o-kgj0txdhpa/ou-r9mj-4j3mzjql",
            "statusSummary": {
                "status": "SUCCEEDED",
                "lastOperationIdentifier": "58f12232-26be-4735-a3e9-dd30d90f021f"
            }
        },
        {
            "arn": "arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XAJ9NKW88AA4W9CLL",
            "baselineIdentifier": "arn:aws:controltower:us-east-1::baseline:17BSJV3IGJ2QSGA2",
            "baselineVersion": "4.0",
            "targetIdentifier": "arn:aws:organizations::123456789012:ou/o-s9511vn103/ou-xqj7-fex1u317",
            "statusSummary": {
            "status": "FAILED",
                "lastOperationIdentifier": "81e02df1-2b4d-48f0-838f-3833b93dcdc0"
            }
        }
    ],
    "nextToken": "e2bXXXXX6cab"
}
```

使用一种筛选条件（`baselineIdentifiers` 筛选条件）的 CLI 示例：

```
aws controltower list-enabled-baselines \
    --filter baselineIdentifiers=arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2,arn:aws:controltower:us-west-2::baseline/LN25R72TTG6IGPTQ \
    --region us-west-2
```

使用多种筛选条件（`baselineIdentifiers` 和 `targetIdentifiers` 筛选条件）的 CLI 示例：

```
aws controltower list-enabled-baselines \
    --filter targetIdentifiers=arn:aws:organizations::123456789012:ou/o-aq21sw43de5/ou-po90-lk87jh65,baselineIdentifiers=arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2 \
    --region us-west-2
```

## `ResetEnabledBaseline`
<a name="reset-enabled-baseline"></a>

有关此 API 操作的更多信息，请参阅[ResetEnabledBaseline](https://docs.aws.amazon.com//controltower/latest/APIReference/API_ResetEnabledBaseline.html)。

`ResetEnabledbaseline` 输入：

```
{
    "enabledBaselineIdentifier": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAJ9NKW88AA4W9CLL"
}
```

`ResetEnabledBaseline` 输出：

```
{
    "operationIdentifier": "81e02df1-2b4d-48f0-838f-3833b93dcdc0"
}
```

`ResetEnabledBaseline` CLI 示例：

```
aws controltower reset-enabled-baseline \
    --enabled-baseline-identifier arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHXS7P6C4I453EZC \
    --region us-west-2
```

## `UpdateEnabledBaseline`
<a name="update-enabled-baseline"></a>

有关此 API 操作的更多信息，请参阅[UpdateEnabledBaseline](https://docs.aws.amazon.com//controltower/latest/APIReference/API_UpdateEnabledBaseline.html)。

`UpdateEnabledBaseline` 输入：

```
{
    "enabledBaselineIdentifier": "arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XAJ9NKW88AA4W9CLL",
    "baselineVersion": "4.0",
    "parameters": [
        {
            "key": "IdentityCenterEnabledBaselineArn",
            "value": "arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XAHCR4CJTSI4W07MZ"
        }
    ] 
}
```

`UpdateEnabledBaseline` 输出：

```
{
    "operationIdentifier": "81e02df1-2b4d-48f0-838f-3833b93dcdc0"
}
```

`UpdateEnabledBaseline` CLI 示例：

```
aws controltower update-enabled-baseline \
    --enabled-baseline-identifier arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHXS7P6C4I453EZC \
    --baseline-version 4.0
    --parameters '[{"key":"IdentityCenterEnabledBaselineArn","value":"arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHXS7P6C4I453EZC"}]' \
    --region us-west-2
```