View a markdown version of this page

Control Tower 中的生命周期事件 - AWS Control Tower
CreateManagedAccountUpdateManagedAccountEnableGuardrailDisableGuardrailSetupLandingZoneUpdateLandingZoneRegisterOrganizationalUnitDeregisterOrganizationalUnitPrecheckOrganizationalUnitEnableBaselineResetEnabledBaselineUpdateEnabledBaselineDisableBaselineEnableControlResetEnabledControlUpdateEnabledControlDisableControl

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

Control Tower 中的生命周期事件

AWS Control Tower 记录的某些事件是生命周期事件。生命周期事件的目的是标记某些更改资源状态的 AWS Control Tower 操作的完成。生命周期事件适用于 AWS Control Tower 创建或管理的资源，例如与组织单元（OU）或账户相关的登录区、基准或控件。

AWS Control Tower 生命周期事件的功能

  • 对于每个生命周期事件，事件日志均显示发端 Control Tower 操作是成功完成，还是失败。

  • AWS CloudTrail 自动将每个生命周期事件记录为非 API AWS 服务事件。有关更多信息，请参阅《 AWS CloudTrail 用户指南》。

  • 每个生命周期事件也将传送到亚马逊 EventBridge 和亚马逊 CloudWatch 活动服务处。注意：要在中接收生命周期事件 EventBridge，必须有一个启用了日志记录的活动 AWS CloudTrail 跟踪。有关通过交付的 AWS 服务事件的更多信息 AWS CloudTrail，请参阅《亚马逊 EventBridge 用户指南》 CloudTrail中通过 AWS 交付的 AWS 服务事件。

AWS Control Tower 中的生命周期事件有两项主要优势：

  • 由于生命周期事件记录了 AWS Control Tower 操作的完成，因此您可以创建亚马逊 EventBridge 规则或 Amazon Ev CloudWatch ents 规则，根据生命周期事件的状态触发自动化工作流程中的后续步骤。

  • 日志提供了其他详细信息，以帮助管理员和审核员查看组织中的某些类型的活动。

生命周期事件的工作原理

AWS Control Tower 依赖多项服务来实施其操作。因此，只有在一系列操作完成后，才会记录每个生命周期事件。例如，当您对某个 OU 启用控件时，AWS Control Tower 会启动一系列子步骤以实施该请求。整个子步骤系列的最终结果将作为生命周期事件的状态记录在日志中。

  • 如果每个基础子步骤都成功完成，则生命周期事件状态将记录为 Succeeded (已成功)。

  • 如有任何基础子步骤未成功完成，则生命周期事件状态将记录为 Failed (已失败)。

每个生命周期事件都包含一个记录的时间戳，显示 AWS Control Tower 操作的启动时间，以及另一个时间戳，显示生命周期事件的完成时间，同时标记成功或失败。

在 Control Tower 中查看生命周期事件

您可以从 AWS Control Tower 控制面板的活动页面查看生命周期事件。

  • 要导航到 Activities (活动) 页面，请从左侧导航窗格中选择 Activities (活动)。

  • 要获取有关特定事件的更多详细信息，请选择该事件，然后选择右上角的 View details (查看详细信息) 按钮。

有关如何将 AWS Control Tower 生命周期事件集成到工作流中的更多信息，请参阅博客文章使用生命周期事件跟踪 AWS Control Tower 操作并触发自动化工作流。

预期行为 CreateManagedAccount 和 UpdateManagedAccount生命周期事件

当您在 AWS Control Tower 中创建账户或注册账户时，这两项操作会调用相同的内部 API。如果在此过程中出现错误，则通常发生在账户创建但尚未完全预置之后。当您在错误发生后重新尝试创建账户或尝试更新预置产品时，AWS Control Tower 会发现账户已经存在。

由于账户存在，AWS Control Tower 会在重试请求结束时记录 UpdateManagedAccount 生命周期事件，而不是 CreateManagedAccount 生命周期事件。由于该错误，您可能希望看到另一个 CreateManagedAccount 事件。但是，UpdateManagedAccount 生命周期事件是预期和期望的行为。

如果您计划使用自动化方法创建账户或在 AWS Control Tower 中注册账户，请编程 Lambda 函数以查找UpdateManagedAccount生命周期事件和CreateManagedAccount生命周期事件。

生命周期事件名称

每个生命周期事件的命名都与最初的 AWS 控制塔操作相对应，该操作也由 AWS 记录 CloudTrail。因此，例如，由 AWS 控制塔事件引发的生命周期CreateManagedAccount CloudTrail 事件被命名CreateManagedAccount。

以下列表中的每个名称都是一条指向记录详细信息（JSON 格式）示例的链接。这些示例中显示的其他详细信息取自亚马逊 CloudWatch 事件日志。

虽然 JSON 不支持注释，但为了便于解释，还是在示例中添加了一些注释。注释显示在示例的右侧，前面带有“//”。

在这些示例中，某些账户名称和组织名称被遮盖。accountId 始终是由 12 个数字组成的序列，在示例中已替换为“xxxxxxxxxxxx”。organizationalUnitID 是由字母和数字组成的唯一字符串。它的形式在示例中保留下来。

  • CreateManagedAccount：该日志记录 AWS Control Tower 是否成功完成了使用 Account Factory 创建和预置新账户的每项操作。

  • UpdateManagedAccount：该日志记录 AWS Control Tower 是否成功完成了更新与您之前使用 Account Factory 创建的账户相关联的预置产品的每项操作。

  • EnableGuardrail：该日志记录 AWS 控制塔是否成功完成了启用对 OU 的控制的所有操作。

  • DisableGuardrail：该日志记录 AWS 控制塔是否成功完成了禁用对 OU 的控制的所有操作。

  • SetupLandingZone：该日志记录 AWS Control Tower 是否成功完成了设置登录区的每项操作。

  • UpdateLandingZone：该日志记录 AWS Control Tower 是否成功完成了更新现有登录区的每项操作。

  • RegisterOrganizationalUnit：该日志记录 AWS Control Tower 是否成功完成了对 OU 启用其监管功能的每项操作。

  • DeregisterOrganizationalUnit：该日志记录 AWS Control Tower 是否成功完成了对 OU 禁用其监管功能的每项操作。

  • PrecheckOrganizationalUnit：该日志记录 AWS Control Tower 是否检测到了任何会阻止扩展监管操作成功完成的资源。

  • EnableBaseline：该日志记录 AWS Control Tower 是否成功完成了在 OU 下目标成员账户上启用新基准的每一项操作。可以使用 EnableBaseline API 或控制台启动该启用操作。

  • ResetEnabledBaseline：该日志记录 AWS Control Tower 是否成功完成了在 OU 下目标成员账户上重置现有已启用基准的每一项操作。可以使用 ResetEnabledBaseline API 或控制台启动该重置操作。

  • UpdateEnabledBaseline：该日志记录 AWS Control Tower 是否成功完成了在 OU 下目标成员账户上更新现有已启用基准的每一项操作。可以使用 UpdateEnabledBaseline API 或控制台启动该更新操作。

  • DisableBaseline：该日志记录 AWS Control Tower 是否成功完成了在 OU 下目标成员账户上禁用现有已启用基准的每一项操作。可以使用 DisableBaseline API 或控制台启动该禁用操作。

  • EnableControl：该日志记录 AWS 控制塔是否成功完成了在 OU 下启用对目标账户的控制的所有操作。可以使用 EnableControl API 或控制台启动该启用操作。

  • ResetEnabledControl：该日志记录 AWS Control Tower 是否成功完成了重置在 OU 下的目标账户上已启用控制的所有操作。可以使用 ResetEnabledControl API 或控制台启动该重置操作。

  • UpdateEnabledControl：该日志记录 AWS Control Tower 是否成功完成了更新OU下目标账户上已启用控制的所有操作。可以使用 UpdateEnabledControl API 或控制台启动该更新操作。

  • DisableControl：该日志记录 AWS Control Tower 是否成功完成了在 OU 下的目标账户上禁用现有已启用控制的所有操作。可以使用 DisableControl API 或控制台启动该禁用操作。

以下各节提供了 AWS Control Tower 生命周期事件的列表，其中包含为各类生命周期事件记录的详细信息示例。

CreateManagedAccount

此生命周期事件记录 AWS Control Tower 是否成功使用 Account Factory 创建和预置了新账户。此事件对应于 AWS 控制塔CreateManagedAccount CloudTrail 事件。该生命周期事件日志包含新创建账户的 accountName 和 accountId，以及账户所在 OU 的 organizationalUnitName 和 organizationalUnitId。

{
    "version": "0",
    "id": "999cccaa-eaaa-0000-1111-123456789012",         
    "detail-type": "AWS Service Event via CloudTrail",
    "source": "aws.controltower",
    "account": "XXXXXXXXXXXX",                                   // Management account ID. 
    "time": "2018-08-30T21:42:18Z",                              // Format: yyyy-MM-dd'T'hh:mm:ssZ 
    "region": "us-east-1",                                       // AWS Control Tower home region.
    "resources": [ ],
    "detail": {
        "eventVersion": "1.05",
        "userIdentity": {
            "accountId": "XXXXXXXXXXXX",                       
            "invokedBy": "AWS Internal"
        },
        "eventTime": "2018-08-30T21:42:18Z",                     // Timestamp when call was made. Format: yyyy-MM-dd'T'hh:mm:ssZ.
        "eventSource": "controltower.amazonaws.com",
        "eventName": "CreateManagedAccount",                  
        "awsRegion": "us-east-1",                               
        "sourceIPAddress": "AWS Internal",
        "userAgent": "AWS Internal",
        "eventID": "0000000-0000-0000-1111-123456789012",        
        "readOnly": false,
        "eventType": "AwsServiceEvent",
        "serviceEventDetails": {
            "createManagedAccountStatus": {
                "organizationalUnit":{
                    "organizationalUnitName":"Custom",
                    "organizationalUnitId":"ou-XXXX-l3zc8b3h"

                    },
                "account":{
                    "accountName":"LifeCycle1",
                    "accountId":"XXXXXXXXXXXX"
                    },
                "state":"SUCCEEDED",
                "message":"AWS Control Tower successfully created a managed account.",
                "requestedTimestamp":"2019-11-15T11:45:18+0000",
                "completedTimestamp":"2019-11-16T12:09:32+0000"}
        }
    }
}

UpdateManagedAccount

此生命周期事件记录 AWS Control Tower 是否成功更新了与之前使用 Account Factory 创建的账户相关联的预置产品。此事件对应于 AWS 控制塔UpdateManagedAccount CloudTrail事件。该生命周期事件日志包含关联账户的 accountName 和 accountId，以及更新账户所在 OU 的 organizationalUnitName 和 organizationalUnitId。

{
    "version": "0",
    "id": "999cccaa-eaaa-0000-1111-123456789012",                
    "detail-type": "AWS Service Event via CloudTrail",
    "source": "aws.controltower",
    "account": "XXXXXXXXXXXX",                                   // AWS Control Tower organization management account.
    "time": "2018-08-30T21:42:18Z",                              // Format: yyyy-MM-dd'T'hh:mm:ssZ 
    "region": "us-east-1",                                       // AWS Control Tower home region.
    "resources": [],
    "detail": {
        "eventVersion": "1.05",
        "userIdentity": {
            "accountId": "XXXXXXXXX",                        
            "invokedBy": "AWS Internal"
        },
        "eventTime": "2018-08-30T21:42:18Z",                     // Timestamp when call was made. Format: yyyy-MM-dd'T'hh:mm:ssZ.
        "eventSource": "controltower.amazonaws.com",
        "eventName": "UpdateManagedAccount",                   
        "awsRegion": "us-east-1",                                
        "sourceIPAddress": "AWS Internal",
        "userAgent": "AWS Internal",
        "eventID": "0000000-0000-0000-1111-123456789012",        
        "readOnly": false,
        "eventType": "AwsServiceEvent",
        "serviceEventDetails": {
            "updateManagedAccountStatus": {
                "organizationalUnit":{
                    "organizationalUnitName":"Custom",
                    "organizationalUnitId":"ou-XXXX-l3zc8b3h"
                    },
                "account":{
                    "accountName":"LifeCycle1",
                    "accountId":"XXXXXXXXXXXX"
                    },
                "state":"SUCCEEDED",
                "message":"AWS Control Tower successfully updated a managed account.",
                "requestedTimestamp":"2019-11-15T11:45:18+0000",
                "completedTimestamp":"2019-11-16T12:09:32+0000"}
        }
    }
}

EnableGuardrail

此生命周期事件记录 AWS Control Tower 是否成功对正由 AWS Control Tower 托管的 OU 启用了控件。此事件对应于 AWS 控制塔EnableGuardrail CloudTrail 事件。该生命周期事件日志包含控件的 guardrailId 和 guardrailBehavior，以及启用了控件的 OU 的 organizationalUnitName 和 organizationalUnitId。

{
    "version": "0",
    "id": "999cccaa-eaaa-0000-1111-123456789012",         
    "detail-type": "AWS Service Event via CloudTrail",
    "source": "aws.controltower",
    "account": "XXXXXXXXXXXX",                                 
    "time": "2018-08-30T21:42:18Z",                              // End-time of action. Format: yyyy-MM-dd'T'hh:mm:ssZ 
    "region": "us-east-1",                                       // AWS Control Tower home region.
    "resources": [ ],
    "detail": {
        "eventVersion": "1.05",
        "userIdentity": {
            "accountId": "XXXXXXXXXXXX",                    
            "invokedBy": "AWS Internal"
        },
        "eventTime": "2018-08-30T21:42:18Z",                  
        "eventSource": "controltower.amazonaws.com",             
        "eventName": "EnableGuardrail",                   
        "awsRegion": "us-east-1",                              
        "sourceIPAddress": "AWS Internal",
        "userAgent": "AWS Internal",
        "eventID": "0000000-0000-0000-1111-123456789012",       
        "readOnly": false,
        "eventType": "AwsServiceEvent",
        "serviceEventDetails": {
            "enableGuardrailStatus": {
                "organizationalUnits": [
                    {
                      "organizationalUnitName": "Custom",
                      "organizationalUnitId": "ou-vwxy-18vy4yro"
                    }
                  ],
                  "guardrails": [
                    {
                      "guardrailId": "AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK",
                      "guardrailBehavior": "DETECTIVE"
                    }
                  ],
                  "state": "SUCCEEDED",
                  "message": "AWS Control Tower successfully enabled a guardrail on an organizational unit.",
                  "requestTimestamp": "2019-11-12T09:01:07+0000",
                  "completedTimestamp": "2019-11-12T09:01:54+0000"
                }
        }
    }
}

DisableGuardrail

此生命周期事件记录 AWS Control Tower 是否成功对正由 AWS Control Tower 托管的 OU 禁用了控件。此事件对应于 AWS 控制塔DisableGuardrail CloudTrail 事件。该生命周期事件记录包含控件的 guardrailId 和 guardrailBehavior，以及禁用了控件的 OU 的 organizationalUnitName 和 organizationalUnitId。

{
    "version": "0",
    "id": "999cccaa-eaaa-0000-1111-123456789012",     
    "detail-type": "AWS Service Event via CloudTrail",
    "source": "aws.controltower",
    "account": "XXXXXXXXXXXX",                         
    "time": "2018-08-30T21:42:18Z",                   
    "region": "us-east-1",                           
    "resources": [ ],
    "detail": {
        "eventVersion": "1.05",
        "userIdentity": {
            "accountId": "XXXXXXXXXXXX",                 
            "invokedBy": "AWS Internal"
        },
        "eventTime": "2018-08-30T21:42:18Z",            
        "eventSource": "controltower.amazonaws.com",
        "eventName": "DisableGuardrail",                 
        "awsRegion": "us-east-1",                            
        "sourceIPAddress": "AWS Internal",
        "userAgent": "AWS Internal",
        "eventID": "0000000-0000-0000-1111-123456789012",     
        "readOnly": false,
        "eventType": "AwsServiceEvent",
        "serviceEventDetails": {
            "disableGuardrailStatus": {
                   "organizationalUnits": [
                    {
                      "organizationalUnitName": "Custom",
                      "organizationalUnitId": "ou-vwxy-18vy4yro"
                    }
                  ],
                  "guardrails": [
                    {
                      "guardrailId": "AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK",
                      "guardrailBehavior": "DETECTIVE"
                    }
                  ],
                  "state": "SUCCEEDED",
                  "message": "AWS Control Tower successfully disabled a guardrail on an organizational unit.",
                  "requestTimestamp": "2019-11-12T09:01:07+0000",
                  "completedTimestamp": "2019-11-12T09:01:54+0000"
                }
            }
        }
    }

SetupLandingZone

此生命周期事件记录 AWS Control Tower 是否成功设置了登录区。此事件对应于 AWS 控制塔SetupLandingZone CloudTrail 事件。该生命周期事件日志包含 rootOrganizationalId，这是 AWS Control Tower 从管理账户创建的组织的 ID。该日志条目还包含每个 OU 的 organizationalUnitName 和 organizationalUnitId，以及在 AWS Control Tower 设置登录区时为每个账户创建的 accountName 和 accountId。

{
    "version": "0",
    "id": "999cccaa-eaaa-0000-1111-123456789012",                // Request ID.
    "detail-type": "AWS Service Event via CloudTrail",
    "source": "aws.controltower",
    "account": "XXXXXXXXXXXX",                                   // Management account ID.
    "time": "2018-08-30T21:42:18Z",                              // Event time from CloudTrail.
    "region": "us-east-1",                                       // Management account CloudTrail region.
    "resources": [ ],
    "detail": {
        "eventVersion": "1.05",
        "userIdentity": {
            "accountId": "XXXXXXXXXXXX",                         // Management-account ID.
            "invokedBy": "AWS Internal"
        },
        "eventTime": "2018-08-30T21:42:18Z",                     // Timestamp when call was made. Format: yyyy-MM-dd'T'hh:mm:ssZ.
        "eventSource": "controltower.amazonaws.com",
        "eventName": "SetupLandingZone",
        "awsRegion": "us-east-1",                                // AWS Control Tower home region.
        "sourceIPAddress": "AWS Internal",
        "userAgent": "AWS Internal",
        "eventID": "CloudTrail_event_ID",                        // This value is generated by CloudTrail.
        "readOnly": false,
        "eventType": "AwsServiceEvent",
        "serviceEventDetails": {
            "setupLandingZoneStatus": {
                "state": "SUCCEEDED",                             // Status of entire lifecycle operation.
                "message": "AWS Control Tower successfully set up a new landing zone.",                
                "rootOrganizationalId" : "r-1234",
                "organizationalUnits" : [                         // Use a list.
                  {
                    "organizationalUnitName": "Security",             // Security OU name.
                    "organizationalUnitId": "ou-adpf-302pk332"    // Security OU ID.
                  },
                  {
                    "organizationalUnitName": "Custom",           // Custom OU name.
                    "organizationalUnitId": "ou-adpf-302pk332"    // Custom OU ID. 
                  },
                ],
               "accounts": [                                      // All created accounts are here. Use a list of "account" objects.

                  {
                    "accountName": "Audit",  
                    "accountId": "XXXXXXXXXXXX"                        
                  },
                  {
                    "accountName": "Log archive",                 
                    "accountId": "XXXXXXXXXXXX"
                  }
              ],
              "requestedTimestamp": "2018-08-30T21:42:18Z",
              "completedTimestamp": "2018-08-30T21:42:18Z"
            }
        }
    }
}

UpdateLandingZone

此生命周期事件记录 AWS Control Tower 是否成功更新了您的现有登录区。此事件对应于 AWS 控制塔UpdateLandingZone CloudTrail 事件。该生命周期事件日志包含 rootOrganizationalId，这是由 AWS Control Tower 监管的（已更新）组织的 ID。该日志条目还包含每个 OU 的 organizationalUnitName 和 organizationalUnitId，以及之前在 AWS Control Tower 最初设置登录区时为每个账户创建的 accountName 和 accountId。

{
    "version": "0",
    "id": "999cccaa-eaaa-0000-1111-123456789012",                // Request ID.
    "detail-type": "AWS Service Event via CloudTrail",
    "source": "aws.controltower",
    "account": "XXXXXXXXXXXX",                                   // Management account ID.
    "time": "2018-08-30T21:42:18Z",                              // Event time from CloudTrail.
    "region": "us-east-1",                                       // Management account CloudTrail region.
    "resources": [ ],
    "detail": {
        "eventVersion": "1.05",
        "userIdentity": {
            "accountId": "XXXXXXXXXXXX",                         // Management account ID.
            "invokedBy": "AWS Internal"
        },
        "eventTime": "2018-08-30T21:42:18Z",                     // Timestamp when call was made. Format: yyyy-MM-dd'T'hh:mm:ssZ.
        "eventSource": "controltower.amazonaws.com",
        "eventName": "UpdateLandingZone",
        "awsRegion": "us-east-1",                                // AWS Control Tower home region.
        "sourceIPAddress": "AWS Internal",
        "userAgent": "AWS Internal",
        "eventID": "CloudTrail_event_ID",                        // This value is generated by CloudTrail.

        "readOnly": false,
        "eventType": "AwsServiceEvent",
        "serviceEventDetails": {
            "updateLandingZoneStatus": {
                "state": "SUCCEEDED",                            // Status of entire operation.
                "message": "AWS Control Tower successfully updated a landing zone.",                

                "rootOrganizationalId" : "r-1234",
                "organizationalUnits" : [                         // Use a list.
                  {
                    "organizationalUnitName": "Security",             // Security OU name.
                    "organizationalUnitId": "ou-adpf-302pk332"    // Security OU ID.
                  },
                  {
                    "organizationalUnitName": "Custom",            // Custom OU name.
                    "organizationalUnitId": "ou-adpf-302pk332"     // Custom OU ID.
                  },
                ],
               "accounts": [                                       // All created accounts are here. Use a list of "account" objects.

                  {
                    "accountName": "Audit",  
                    "accountId": "XXXXXXXXXXXX"                        
                  },
                  {
                    "accountName": "Log archive",                 
                    "accountId": "XXXXXXXXXX"
                  }
              ],
              "requestedTimestamp": "2018-08-30T21:42:18Z",
              "completedTimestamp": "2018-08-30T21:42:18Z"
            }
        }
    }
}

RegisterOrganizationalUnit

此生命周期事件记录 AWS Control Tower 是否成功对 OU 启用了其监管功能。此事件对应于 AWS 控制塔RegisterOrganizationalUnit CloudTrail 事件。该生命周期事件日志包含 AWS Control Tower 已纳入其监管之下的 OU 的 organizationalUnitName 和 organizationalUnitId。

{
    "version": "0",
    "id": "999cccaa-eaaa-0000-1111-123456789012",            
    "detail-type": "AWS Service Event via CloudTrail", 
    "source": "aws.controltower",
    "account": "123456789012",                               
    "time": "2018-08-30T21:42:18Z",                  
    "region": "us-east-1",                       
    "resources": [ ],
    "detail": {
        "eventVersion": "1.05",
        "userIdentity": {
            "accountId": "XXXXXXXXXXXX",                
            "invokedBy": "AWS Internal"
        },
        "eventTime": "2018-08-30T21:42:18Z",               
        "eventSource": "controltower.amazonaws.com",
        "eventName": "RegisterOrganizationalUnit",        
        "awsRegion": "us-east-1",                           
        "sourceIPAddress": "AWS Internal",
        "userAgent": "AWS Internal",
        "eventID": "0000000-0000-0000-1111-123456789012",    
        "readOnly": false,
        "eventType": "AwsServiceEvent",
        "serviceEventDetails": {
            "registerOrganizationalUnitStatus": {
                "state": "SUCCEEDED",                        

                "message": "AWS Control Tower successfully registered an organizational unit.",

                "organizationalUnit" :                        
                  {
                    "organizationalUnitName": "Test",            
                    "organizationalUnitId": "ou-adpf-302pk332"    
                  }
                "requestedTimestamp": "2018-08-30T21:42:18Z",
                "completedTimestamp": "2018-08-30T21:42:18Z" 
            }
        }
    }
}

DeregisterOrganizationalUnit

此生命周期事件记录 AWS Control Tower 是否成功对 OU 禁用了其监管功能。此事件对应于 AWS 控制塔DeregisterOrganizationalUnit CloudTrail 事件。该生命周期事件日志包含 AWS Control Tower 已禁用其监管功能的 OU 的 organizationalUnitName 和 organizationalUnitId。

{
    "version": "0",
    "id": "999cccaa-eaaa-0000-1111-123456789012",    
    "detail-type": "AWS Service Event via CloudTrail",
    "source": "aws.controltower",
    "account": "XXXXXXXXXXXX",                  
    "time": "2018-08-30T21:42:18Z", 
    "region": "us-east-1",            
    "resources": [ ],
    "detail": {
        "eventVersion": "1.05",
        "userIdentity": {
            "accountId": "XXXXXXXXXXXX",              
            "invokedBy": "AWS Internal"
        },
        "eventTime": "2018-08-30T21:42:18Z",               
        "eventSource": "controltower.amazonaws.com",
        "eventName": "DeregisterOrganizationalUnit",     
        "awsRegion": "us-east-1",                       
        "sourceIPAddress": "AWS Internal",
        "userAgent": "AWS Internal",
        "eventID": "0000000-0000-0000-1111-123456789012", 
        "readOnly": false,
        "eventType": "AwsServiceEvent",
        "serviceEventDetails": {
            "deregisterOrganizationalUnitStatus": {                 
                "state": "SUCCEEDED",               
                "message": "AWS Control Tower successfully de-registered an organizational unit.",
                "organizationalUnit" :                        
                  {
                    "organizationalUnitName": "Test",                   // Foundational OU name.
                    "organizationalUnitId": "ou-adpf-302pk332"          // Foundational OU ID.
                  },
                "requestedTimestamp": "2018-08-30T21:42:18Z", 
                "completedTimestamp": "2018-08-30T21:42:18Z"  
            }
            }
        }
    }

PrecheckOrganizationalUnit

此生命周期事件记录 AWS Control Tower 是否成功对 OU 执行了预检查。此事件对应于 AWS 控制塔PrecheckOrganizationalUnit CloudTrail 事件。该生命周期事件日志包含 Id、Name 和 failedPrechecks 值对应的字段，用于记录在 OU 注册过程中 AWS Control Tower 对其执行了预检查的每项资源。

该事件日志还包含有关对其执行预检查的嵌套账户的信息，包括 accountName、accountId 和 failedPrechecks 字段。

如果 failedPrechecks 值为空，则表示该资源的所有预检查均成功通过。

  • 只有当预检查失败时，才会触发该事件。

  • 如果注册的是空 OU，则不会触发此事件。

事件示例：

{
  "eventVersion": "1.08",
  "userIdentity": {
    "accountId": "XXXXXXXXXXXX",
    "invokedBy": "AWS Internal"
  },
  "eventTime": "2021-09-20T22:45:43Z",
  "eventSource": "controltower.amazonaws.com",
  "eventName": "PrecheckOrganizationalUnit",
  "awsRegion": "us-west-2",
  "sourceIPAddress": "AWS Internal",
  "userAgent": "AWS Internal",
  "eventID": "b41a9d67-0da4-4dc5-a87a-25fa19dc5305",
  "readOnly": false,
  "eventType": "AwsServiceEvent",
  "managementEvent": true,
  "recipientAccountId": "XXXXXXXXXXXX",
  "serviceEventDetails": {
    "precheckOrganizationalUnitStatus": {
      "organizationalUnit": {
        "organizationalUnitName": "Ou-123",
        "organizationalUnitId": "ou-abcd-123456",
        "failedPrechecks": [
            "SCP_CONFLICT"
          ]
      },
      "accounts": [
        {
          "accountName": "Child Account 1",
          "accountId": "XXXXXXXXXXXX",
          "failedPrechecks": [
            "FAILED_TO_ASSUME_ROLE"
          ]
        },
        {
          "accountName": "Child Account 2",
          "accountId": "XXXXXXXXXXXX",
          "failedPrechecks": [
            "FAILED_TO_ASSUME_ROLE"
          ]
        },
        {
          "accountName": "Management Account",
          "accountId": "XXXXXXXXXXXX",
          "failedPrechecks": [
            "MISSING_PERMISSIONS_AF_PRODUCT"
          ]
        },
        {
          "accountName": "Child Account 3",
          "accountId": "XXXXXXXXXXXX",
          "failedPrechecks": []
        },
        ...
      ],
      "state": "FAILED",
      "message": "AWS Control Tower failed to register an organizational unit due to pre-check failures. Go to the OU details page to download a list of failed pre-checks for the OU and accounts within.",
      "requestedTimestamp": "2021-09-20T22:44:02+0000",
      "completedTimestamp": "2021-09-20T22:45:43+0000"
    }
  },
  "eventCategory": "Management"
}

EnableBaseline

此生命周期事件记录 AWS Control Tower 是否成功对 OU 下目标成员账户启用了基准。此事件对应于 AWS 控制塔RegisterOrganizationalUnit或EnableBaseline CloudTrail 事件。生命周期事件日志包括已启用的基准及其版本、启用基准的 targetIdentifier、在父 OU 上启用的基准的 parentIdentifier 和显示 SUCCEEDED 或 FAILED 状态的 statusSummary，以及操作的其他参数和时间戳。

{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "XXXXXXXXXXXX",
        "invokedBy": "AWS Internal"
    },
    "eventTime": "2025-02-10T17:14:57Z",
    "eventSource": "controltower.amazonaws.com",
    "eventName": "EnableBaseline",
    "awsRegion": "us-east-2",
    "sourceIPAddress": "AWS Internal",
    "userAgent": "AWS Internal",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "366911a2-4fa6-4e4a-ac2b-280f627e0027",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "XXXXXXXXXXXX",
    "serviceEventDetails": {
        "enableBaselineStatus": {
            "enabledBaselineDetails": {
                "arn": "arn:aws:controltower:us-east-2:XXXXXXXXXXXX:enabledbaseline/XXXXXXXXXXXXXXXX",
                "parentIdentifier": "arn:aws:controltower:us-east-2:XXXXXXXXXXXX:enabledbaseline/XXXXXXXXXXXXXXXX",
                "targetIdentifier": "arn:aws:organizations::XXXXXXXXXXXX:account/o-ern76xmzvf/XXXXXXXXXXXX",
                "baselineIdentifier": "arn:aws:controltower:us-east-2::baseline/XXXXXXXXXXXXXXX",
                "baselineVersion": "4.0",
                "statusSummary": {
                    "lastOperationIdentifier": "37f5eb68-e5b9-4c70-ae76-4ca15f6b16de",
                    "status": "SUCCEEDED"
                },
                "parameters": [
                    {
                        "key": "IdentityCenterEnabledBaselineArn",
                        "value": {
                            "untyped": {
                                "object": "arn:aws:controltower:us-east-2:XXXXXXXXXXXX:enabledbaseline/XXXXXXXXXXXXXXXX"                            }
                        }
                    }
                ]
            },
            "requestedTimestamp": "2025-02-10T17:07:09+0000",
            "completedTimestamp": "2025-02-10T17:14:57+0000"
        }
    },
    "eventCategory": "Management"
}

ResetEnabledBaseline

此生命周期事件记录 AWS Control Tower 是否成功对 OU 下目标成员账户重置了现有已启用的基准。此事件对应于 AWS 控制塔RegisterOrganizationalUnit或ResetEnabledBaseline CloudTrail 事件。生命周期事件日志包括已启用的基准及其版本、启用基准的 targetIdentifier、在父 OU 上启用的基准的 parentIdentifier 和显示 SUCCEEDED 或 FAILED 状态的 statusSummary，以及操作的其他参数和时间戳。

{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "XXXXXXXXXXXX",
        "invokedBy": "AWS Internal"
    },
    "eventTime": "2025-02-10T21:17:55Z",
    "eventSource": "controltower.amazonaws.com",
    "eventName": "ResetEnabledBaseline",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "AWS Internal",
    "userAgent": "AWS Internal",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "c01a32e1-13ab-4b46-8f1b-00699ef6f989",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "XXXXXXXXXXXX",
    "serviceEventDetails": {
        "resetEnabledBaselineStatus": {
            "enabledBaselineDetails": {
                "arn": "arn:aws:controltower:us-west-2:XXXXXXXXXXXX:enabledbaseline/XXXXXXXXXXXXXXXX",
                "parentIdentifier": "arn:aws:controltower:us-west-2:XXXXXXXXXXXX:enabledbaseline/XXXXXXXXXXXXXXXX",
                "targetIdentifier": "arn:aws:organizations::XXXXXXXXXXXX:account/o-0uh2kplf6d/XXXXXXXXXXXX",
                "baselineIdentifier": "arn:aws:controltower:us-west-2::baseline/XXXXXXXXXXXXXXX",
                "baselineVersion": "1.0",
                "statusSummary": {
                    "lastOperationIdentifier": "3e364c89-89fa-42b8-9776-9f7cc47ba1fa",
                    "status": "SUCCEEDED"
                },
                "parameters": []
            },
            "requestedTimestamp": "2025-02-10T21:14:24Z",
            "completedTimestamp": "2025-02-10T21:17:54+0000"
        }
    },
    "eventCategory": "Management"
}

UpdateEnabledBaseline

此生命周期事件记录 AWS Control Tower 是否成功对 OU 下目标成员账户更新了现有已启用的基准。此事件对应于 AWS 控制塔RegisterOrganizationalUnit或UpdateEnabledBaseline CloudTrail事件。生命周期事件日志包括已启用的基准及其版本、启用基准的 targetIdentifier、在父 OU 上启用的基准的 parentIdentifier 和显示 SUCCEEDED 或 FAILED 状态的 statusSummary，以及操作的其他参数和时间戳。

{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "XXXXXXXXXXXX",
        "invokedBy": "AWS Internal"
    },
    "eventTime": "2025-02-10T19:45:28Z",
    "eventSource": "controltower.amazonaws.com",
    "eventName": "UpdateEnabledBaseline",
    "awsRegion": "us-east-2",
    "sourceIPAddress": "AWS Internal",
    "userAgent": "AWS Internal",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "514f2aff-1a99-4912-bda1-0d4d6662c96e",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "XXXXXXXXXXXX",
    "serviceEventDetails": {
        "updateEnabledBaselineStatus": {
            "enabledBaselineDetails": {
                "arn": "arn:aws:controltower:us-east-2:XXXXXXXXXXXX:enabledbaseline/XXXXXXXXXXXXXXXX",
                "parentIdentifier": "arn:aws:controltower:us-east-2:XXXXXXXXXXXX:enabledbaseline/XXXXXXXXXXXXXXXX",
                "targetIdentifier": "arn:aws:organizations::XXXXXXXXXXXX:account/o-ern76xmzvf/XXXXXXXXXXXX",
                "baselineIdentifier": "arn:aws:controltower:us-east-2::baseline/XXXXXXXXXXXXXXX",
                "baselineVersion": "4.0",
                "statusSummary": {
                    "lastOperationIdentifier": "ba3de28f-83fb-4c9a-8a8c-a4e15fac2c41",
                    "status": "SUCCEEDED"
                },
                "parameters": [
                    {
                        "key": "IdentityCenterEnabledBaselineArn",
                        "value": {
                            "untyped": {
                                "object": "arn:aws:controltower:us-east-2:XXXXXXXXXXXX:enabledbaseline/XXXXXXXXXXXXXXXX"                            }
                        }
                    }
                ]
            },
            "requestedTimestamp": "2025-02-10T19:39:35+0000",
            "completedTimestamp": "2025-02-10T19:45:28+0000"
        }
    },
    "eventCategory": "Management"
}

DisableBaseline

此生命周期事件记录 AWS Control Tower 是否成功对 OU 下目标成员账户禁用了现有已启用的基准。此事件对应于 AWS 控制塔DisableBaseline CloudTrail 事件。生命周期事件日志包括已启用的基准及其版本、启用基准的 targetIdentifier、在父 OU 上启用的基准的 parentIdentifier 和显示 SUCCEEDED 或 FAILED 状态的 statusSummary，以及操作的其他参数和时间戳。

{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "XXXXXXXXXXXX",
        "invokedBy": "AWS Internal"
    },
    "eventTime": "2025-03-14T00:50:58Z",
    "eventSource": "controltower.amazonaws.com",
    "eventName": "DisableBaseline",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "AWS Internal",
    "userAgent": "AWS Internal",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "704794c4-a32e-4960-8386-c7efaa5a22a1",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "XXXXXXXXXXXX",
    "serviceEventDetails": {
        "disableBaselineStatus": {
            "enabledBaselineDetails": {
                "arn": "arn:aws:controltower:us-west-2:XXXXXXXXXXXX:enabledbaseline/XXXXXXXXXXXXXXXX",
                "parentIdentifier": "arn:aws:controltower:us-west-2:XXXXXXXXXXXX:enabledbaseline/XXXXXXXXXXXXXXXX",
                "targetIdentifier": "arn:aws:organizations::XXXXXXXXXXXX:account/o-0uh2kplf6d/XXXXXXXXXXXX",
                "baselineIdentifier": "arn:aws:controltower:us-west-2::baseline/XXXXXXXXXXXXXXX",
                "baselineVersion": "1.0",
                "statusSummary": {
                    "lastOperationIdentifier": "7b895594-0edb-48bc-9f3d-d88c2ad618df",
                    "status": "SUCCEEDED"
                },
                "parameters": []
            },
            "baselineDetails": {
                "arn": "arn:aws:controltower:us-west-2:XXXXXXXXXXXX:enabledbaseline/XXXXXXXXXXXXXXXX",
                "parentIdentifier": "arn:aws:controltower:us-west-2:XXXXXXXXXXXX:enabledbaseline/XXXXXXXXXXXXXXXX",
                "targetIdentifier": "arn:aws:organizations::XXXXXXXXXXXX:account/o-0uh2kplf6d/XXXXXXXXXXXX",
                "baselineIdentifier": "arn:aws:controltower:us-west-2::baseline/XXXXXXXXXXXXXXX",
                "baselineVersion": "1.0",
                "statusSummary": {
                    "lastOperationIdentifier": "7b895594-0edb-48bc-9f3d-d88c2ad618df",
                    "status": "SUCCEEDED"
                },
                "parameters": []
            },
            "requestedTimestamp": "2025-03-14T00:49:13Z",
            "completedTimestamp": "2025-03-14T00:50:58+0000"
        }
    },
    "eventCategory": "Management"
}

EnableControl

此生命周期事件记录 AWS 控制塔是否成功启用了对由 AWS 控制塔管理的目标账户的控制。此事件对应于 AWS 控制塔EnableControl CloudTrail 事件，在使用 EnableControl API 或控制台启用控件时发出。生命周期事件日志包括已启用的控件、生成的启用控件arn的日志、父 OU 上已启用控件的targetIdentifier日志、启用该控件的日志、state显示成功或失败状态的日志，以及操作的时间戳。controlIdentifier parentIdentifier message

注意

EnableControl生命周期事件对应于 EnableControl API。启用控件时，AWS 控制塔还会发出传统EnableGuardrail生命周期事件。如果您构建对启用控件做出反应的自动化，请将这两个事件名称都考虑在内。

{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "XXXXXXXXXXXX",
        "invokedBy": "AWS Internal"
    },
    "eventTime": "2026-01-07T15:59:28Z",
    "eventSource": "controltower.amazonaws.com",
    "eventName": "EnableControl",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "AWS Internal",
    "userAgent": "AWS Internal",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "a4f45d0d-ab6d-41c7-9f97-786d80ff23d2",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "XXXXXXXXXXXX",
    "serviceEventDetails": {
        "enableControlStatus": {
            "arn": "arn:aws:controltower:us-east-1:XXXXXXXXXXXX:enabledcontrol/143RH67Q683RJ20V",
            "parentIdentifier": "arn:aws:controltower:us-east-1:XXXXXXXXXXXX:enabledcontrol/8WU3TCOLC0JPSV6T",
            "controlIdentifier": "arn:aws:controltower:us-east-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED",
            "targetIdentifier": "arn:aws:organizations::XXXXXXXXXXXX:account/o-k54j7iydcs/XXXXXXXXXXXX",
            "state": "SUCCEEDED",
            "message": "AWS Control Tower successfully enabled a control on the target.",
            "requestedTimestamp": "2026-01-07T15:59:24+0000",
            "completedTimestamp": "2026-01-07T15:59:28+0000"
        }
    },
    "eventCategory": "Management"
}

ResetEnabledControl

此生命周期事件记录 AWS 控制塔是否成功重置了由 AWS 控制塔管理的目标账户的现有已启用控件。此事件对应于 AWS 控制塔ResetEnabledControl CloudTrail 事件，在使用 ResetEnabledControl API 或控制台重置已启用的控件时发出。生命周期事件日志包括控件controlIdentifier的日志、已启用控件parentIdentifier的日志、父OU上已启用控件的targetIdentifier日志、重置该控件的日志、state显示成功或失败状态的日志，以及操作的时间戳。arn message

{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "XXXXXXXXXXXX",
        "invokedBy": "AWS Internal"
    },
    "eventTime": "2026-01-07T16:10:42Z",
    "eventSource": "controltower.amazonaws.com",
    "eventName": "ResetEnabledControl",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "AWS Internal",
    "userAgent": "AWS Internal",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "c82d6f3a-4b9e-43ca-8d21-1a3f8d5b62e9",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "XXXXXXXXXXXX",
    "serviceEventDetails": {
        "resetEnabledControlStatus": {
            "arn": "arn:aws:controltower:us-east-1:XXXXXXXXXXXX:enabledcontrol/143RH67Q683RJ20V",
            "parentIdentifier": "arn:aws:controltower:us-east-1:XXXXXXXXXXXX:enabledcontrol/8WU3TCOLC0JPSV6T",
            "controlIdentifier": "arn:aws:controltower:us-east-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED",
            "targetIdentifier": "arn:aws:organizations::XXXXXXXXXXXX:account/o-k54j7iydcs/XXXXXXXXXXXX",
            "state": "SUCCEEDED",
            "message": "AWS Control Tower has successfully reset the enabled control on the target.",
            "requestedTimestamp": "2026-01-07T16:10:36+0000",
            "completedTimestamp": "2026-01-07T16:10:42+0000"
        }
    },
    "eventCategory": "Management"
}

UpdateEnabledControl

此生命周期事件记录 AWS 控制塔是否成功更新了由 AWS 控制塔管理的目标账户上的现有已启用控件。此事件对应于 AWS 控制塔UpdateEnabledControl CloudTrail 事件，在使用 UpdateEnabledControl API 或控制台更新已启用的控件时发出。生命周期事件日志包括控件controlIdentifier的日志、已启用控件parentIdentifier的日志、父 OU 上已启用控件的targetIdentifier日志、更新该控件的日志、state显示成功或失败状态的日志，以及操作的时间戳。arn message

{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "XXXXXXXXXXXX",
        "invokedBy": "AWS Internal"
    },
    "eventTime": "2026-01-07T16:25:19Z",
    "eventSource": "controltower.amazonaws.com",
    "eventName": "UpdateEnabledControl",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "AWS Internal",
    "userAgent": "AWS Internal",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "d93e7a4b-5caf-44db-9e32-2b4a9e6c73fa",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "XXXXXXXXXXXX",
    "serviceEventDetails": {
        "updateEnabledControlStatus": {
            "arn": "arn:aws:controltower:us-east-1:XXXXXXXXXXXX:enabledcontrol/143RH67Q683RJ20V",
            "parentIdentifier": "arn:aws:controltower:us-east-1:XXXXXXXXXXXX:enabledcontrol/8WU3TCOLC0JPSV6T",
            "controlIdentifier": "arn:aws:controltower:us-east-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED",
            "targetIdentifier": "arn:aws:organizations::XXXXXXXXXXXX:account/o-k54j7iydcs/XXXXXXXXXXXX",
            "state": "SUCCEEDED",
            "message": "AWS Control Tower successfully updated the enabled control on the target.",
            "requestedTimestamp": "2026-01-07T16:25:13+0000",
            "completedTimestamp": "2026-01-07T16:25:19+0000"
        }
    },
    "eventCategory": "Management"
}

DisableControl

此生命周期事件记录 AWS 控制塔是否成功禁用了由 AWS 控制塔管理的目标账户的现有已启用控件。此事件对应于 AWS 控制塔DisableControl CloudTrail 事件，在使用 DisableControl API 或控制台禁用控件时触发。生命周期事件日志包括控件controlIdentifier的日志、已启用控件parentIdentifier的日志、父 OU 上已启用控件的targetIdentifier日志、禁用该控件的日志、state显示成功或失败状态的日志，以及操作的时间戳。arn message

注意

当控件被禁用时，AWS 控制塔还会发出传统DisableGuardrail生命周期事件。如果您构建的自动化可以对禁用的控件做出反应，请将这两个事件名称都考虑在内。

{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "XXXXXXXXXXXX",
        "invokedBy": "AWS Internal"
    },
    "eventTime": "2026-01-07T16:42:11Z",
    "eventSource": "controltower.amazonaws.com",
    "eventName": "DisableControl",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "AWS Internal",
    "userAgent": "AWS Internal",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "e04f8b5c-6dba-45ec-af43-3c5b0f7d84ab",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "XXXXXXXXXXXX",
    "serviceEventDetails": {
        "disableControlStatus": {
            "arn": "arn:aws:controltower:us-east-1:XXXXXXXXXXXX:enabledcontrol/143RH67Q683RJ20V",
            "parentIdentifier": "arn:aws:controltower:us-east-1:XXXXXXXXXXXX:enabledcontrol/8WU3TCOLC0JPSV6T",
            "controlIdentifier": "arn:aws:controltower:us-east-1::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED",
            "targetIdentifier": "arn:aws:organizations::XXXXXXXXXXXX:account/o-k54j7iydcs/XXXXXXXXXXXX",
            "state": "SUCCEEDED",
            "message": "AWS Control Tower successfully disabled the enabled control on the target.",
            "requestedTimestamp": "2026-01-07T16:42:05+0000",
            "completedTimestamp": "2026-01-07T16:42:11+0000"
        }
    },
    "eventCategory": "Management"
}