第 2 步：启动您的着陆区 - AWS Control Tower

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

第 2 步：启动您的着陆区

Cont AWS rol Tower CreateLandingZone API 需要一个着陆区域版本和一个清单文件作为输入参数。您可以使用清单文件配置以下功能：

编译清单文件后，您就可以创建新的着陆区了。

注意

AWS使用APIs配置和启动着陆区时，Control Tower 不支持区域拒绝控制。使用成功启动着陆区后APIs，您可以使用 Cont AWS rol Tower 控制台配置区域拒绝控制。

  1. 致电 Cont AWS rol Tower CreateLandingZone API。这API需要一个 landing zone 版本和清单文件作为输入。

    aws controltower create-landing-zone --landing-zone-version 3.3 --manifest "file://LandingZoneManifest.json"

    LandingZoneManifest.json 清单示例：

    {
   "governedRegions": ["us-west-2","us-west-1"],
   "organizationStructure": {
       "security": {
           "name": "CORE"
       },
       "sandbox": {
           "name": "Sandbox"
       }
   },
   "centralizedLogging": {
        "accountId": "222222222222",
        "configurations": {
            "loggingBucket": {
                "retentionDays": 60
            },
            "accessLoggingBucket": {
                "retentionDays": 60
            },
            "kmsKeyArn": "arn:aws:kms:us-west-1:123456789123:key/e84XXXXX-6bXX-49XX-9eXX-ecfXXXXXXXXX"
        },
        "enabled": true
   },
   "securityRoles": {
        "accountId": "333333333333"
   },
   "accessManagement": {
        "enabled": true
   }
}
    注意

    如示例所示， CentralizedLogging 和 SecurityRoles 账户AccountId的必须不同。

    输出：

    {
   "arn": "arn:aws:controltower:us-west-2:123456789012:landingzone/1A2B3C4D5E6F7G8H",
   "operationIdentifier": "55XXXXXX-e2XX-41XX-a7XX-446XXXXXXXXX"
}

  2. GetLandingZoneOperationAPI致电查看CreateLandingZone操作状态。GetLandingZoneOperationAPI返回的状态为SUCCEEDEDFAILED、或IN_PROGRESS。

    aws controltower get-landing-zone-operation --operation-identifier "55XXXXXX-eXXX-4XXX-aXXX-44XXXXXXXXXX"

    输出：

    {
    "operationDetails": {
        "operationType": "CREATE",
        "startTime": "Thu Nov 09 20:39:19 UTC 2023",
        "endTime": "Thu Nov 09 21:02:01 UTC 2023",
        "status": "SUCCEEDED"
    }
}

  3. 当状态返回为时SUCCEEDED，您可以致电GetLandingZoneAPI查看着陆区配置。

    aws controltower get-landing-zone --landing-zone-identifier "arn:aws:controltower:us-west-2:123456789123:landingzone/1A2B3C4D5E6F7G8H"

    输出：

    {
    "landingZone": {
        "arn": "arn:aws:controltower:us-west-2:123456789012:landingzone/1A2B3C4D5E6F7G8H",
        "driftStatus": {
            "status": "IN_SYNC"
        },
        "latestAvailableVersion": "3.3",
        "manifest": {
            "accessManagement": {
                "enabled": true
            },
            "securityRoles": {
                "accountId": "333333333333"
            },
            "governedRegions": [
                "us-west-1",
                "eu-west-3",
                "us-west-2"
            ],
            "organizationStructure": {
                "sandbox": {
                    "name": "Sandbox"
                },
                "security": {
                    "name": "Security"
                }
            },
            "centralizedLogging": {
                "accountId": "222222222222",
                "configurations": {
                    "loggingBucket": {
                        "retentionDays": 60
                    },
                    "kmsKeyArn": "arn:aws:kms:us-west-1:123456789123:key/e84XXXXX-6bXX-49XX-9eXX-ecfXXXXXXXXX",
                    "accessLoggingBucket": {
                        "retentionDays": 60
                    }
                },
                "enabled": true
            }
        },
        "status": "PROCESSING",
        "version": "3.3"
    }
}