本文為英文版的機器翻譯版本,如內容有任何歧義或不一致之處,概以英文版為準。
基準線API用法的範例
本節包含 AWS Control Tower 基準線的輸入和輸出參數範例APIs。
DisableBaseline
如需此API作業的詳細資訊,請參閱DisableBaseline。
DisableBaseline
輸入:
{ "enabledBaselineIdentifier": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/AB12CD34EF56GH789" }
DisableBaseline
輸出:
{ "operationIdentifier": "58f12232-26be-4735-a3e9-dd30d90f021f" }
DisableBaseline
CLI例如:
aws controltower disable-baseline \ --enabled-baseline-identifier arn:aws:controltower:us-west-2:123456789012:enabledbaseline/AB12CD34EF56GH789 \ --region us-west-2
EnableBaseline
如需此API作業的詳細資訊,請參閱EnableBaseline。
EnableBaseline
輸入:
{ "baselineIdentifier": "arn:aws:controltower:us-west-2::baseline:17BSJV3IGJ2QSGA2", "targetIdentifier": "arn:aws:organizations::123456789012:ou/o-kgj0txdhpa/ou-r9mj-4j3mzjql", "baselineVersion": "3.0", "parameters": [ { "key": "IdentityCenterEnabledBaselineArn", "value": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHCR4CJTSI4W07MZ" } ] }
EnableBaseline
輸出,返回一個新的資源:
{ "operationIdentifier": "58f12232-26be-4735-a3e9-dd30d90f021f", "arn": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAGF7TNOHRD7ES5VV" }
EnableBaseline
CLI例如:
此範例顯示啟用的基準線 AWS Organizations 已選擇加入 landing zone 的組織 AWS IAM身分識別中心存取權,由 AWS Control Tower 管理。若要擷取您的身分中心EnabledBaseline
識別碼,您可以ListEnabledBaselines
API呼叫身分中心基準上的篩選:(arn:aws:controltower:
Region
::baseline/LN25R72TTG6IGPTQ)
aws controltower list-enabled-baselines \ --filter baselineIdentifiers=arn:aws:controltower:us-west-2::baseline/LN25R72TTG6IGPTQ \ --region us-west-2
響應將顯示EnabledBaseline
詳細信息,顯示其標識符。
{ "enabledBaselines": [ { "arn": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHXS7P6C4I453EZC", "baselineIdentifier": "arn:aws:controltower:us-west-2::baseline/LN25R72TTG6IGPTQ", "targetIdentifier": "arn:aws:organizations::123456789012:account/o-aq21sw43de5/123456789012", "statusSummary": { "status": "SUCCEEDED" } } ] }
注意
記下回應中的ARN值,並將此值作為參數傳遞,以啟用預設基準線。
aws controltower enable-baseline \ --baseline-identifier arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2 \ --baseline-version 3.0 \ --target-identifier arn:aws:organizations::123456789012:ou/o-aq21sw43de5/ou-po90-lk87jh65 \ --parameters '[{"key":"IdentityCenterEnabledBaselineArn","value":"arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHXS7P6C4I453EZC"}]' \ --region us-west-2
對於已從IAM身分識別中心的 AWS Control Tower 管理中選擇退出 landing zone 的組織,請啟用不含參數的基準線。
aws controltower enable-baseline \ --baseline-identifier arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2 \ --baseline-version 3.0 \ --target-identifier arn:aws:organizations::123456789012:ou/o-aq21sw43de5/ou-po90-lk87jh65 \ --region us-west-2
GetBaseline
如需此API作業的詳細資訊,請參閱GetBaseline。
GetBaseline
輸入:
{ "baselineIdentifier": "arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2" }
GetBaseline
輸出:
{ "arn": "arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2", "name": "AWSControlTowerBaseline", "description": "Sets up resources and mandatory controls for member accounts within the target OU, required for AWS Control Tower governance.", }
GetBaseline
CLI例如:
aws controltower get-baseline \ --baseline-identifier arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2 \ --region us-west-2
GetBaselineOperation
如需此API作業的詳細資訊,請參閱GetBaselineOperation。
GetBaselineOperation
輸入:
{ "operationIdentifier": "58f12232-26be-4735-a3e9-dd30d90f021f" }
GetBaselineOperation
輸出:
{ "baselineOperation": { "operationIdentifier": "58f12232-26be-4735-a3e9-dd30d90f021f", "operationType": "DISABLE_BASELINE", "status": "FAILED", "startTime": "2023-01-12T19:05:00Z", "endTime": "2023-01-12T19:45:00Z", "statusMessage": "Can't perform DisableBaseline on a parent target with governed child OUs" } }
GetBaselineOperation
CLI例如:
aws controltower get-baseline-operation \ --operation-identifier 58f12232-26be-4735-a3e9-dd30d90f021f \ --region us-west-2
GetEnabledBaseline
如需此API作業的詳細資訊,請參閱GetEnabledBaseline。
GetEnabledBaseline
輸入:
{ "enabledBaselineIdentifier": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHCR4CJTSI4W07MZ" }
GetEnabledBaseline
輸出:
{ "enabledBaselineDetails": { "arn": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHCR4CJTSI4W07MZ", "baselineIdentifier": "arn:aws:controltower:us-west-2::baseline:17BSJV3IGJ2QSGA2", "baselineVersion": "3.0", "targetIdentifier": "arn:aws:organizations::123456789012:ou/o-kgj0txdhpa/ou-r9mj-4j3mzjql", "statusSummary": { "status": "SUCCEEDED", "lastOperationIdentifier": "58f12232-26be-4735-a3e9-dd30d90f021f" }, "parameters": [ { "key": "IdentityCenterEnabledBaselineArn", "value": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHCR4CJTSI4W07MZ" } ] } }
GetEnabledBaseline
CLI例如:
aws controltower get-enabled-baseline \ --enabled-baseline-identifier arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHXS7P6C4I453EZC \ --region us-west-2
ListBaselines
如需此API作業的詳細資訊,請參閱ListBaselines。
ListBaselines
輸入(使用可選輸入):
{ "nextToken": "AbCd1234", "maxResults": "4" }
ListBaselines
輸出:
{ "baselines": [ { "arn": "arn:aws:controltower:us-west-1::baseline/4T4HA1KMO10S6311", "name": "AuditBaseline", "description": "Sets up resources to monitor security and compliance of accounts in your organization." }, { "arn": "arn:aws:controltower:us-west-1::baseline/J8HX46AHS5MIKQPD", "name": "LogArchiveBaseline", "description": "Sets up a central repository for logs of API activities and resource configurations from accounts in your organization." }, { "arn": "arn:aws:controltower:us-west-1::baseline/LN25R72TTG6IGPTQ", "name": "IdentityCenterBaseline", "description": "Sets up shared resources for AWS Identity Center, which prepares the AWSControlTowerBaseline to set up Identity Center access for accounts." }, { "arn": "arn:aws:controltower:us-west-1::baseline/17BSJV3IGJ2QSGA2", "name": "AWSControlTowerBaseline", "description": "Sets up resources and mandatory controls for member accounts within the target OU, required for AWS Control Tower governance." } ] }
ListBaselines
CLI例如:
aws controltower list-baselines \ --region us-west-2
ListEnabledBaselines
如需此API作業的詳細資訊,請參閱ListEnabledBaselines。
ListEnabledBaselines
輸入(無過濾器):
{ "nextToken": "bde7-XX0c6fXXXXXX", "maxResults": 5 }
ListEnabledBaselines
輸入(僅限baselineIdentifiers
過濾器):
{ "filter": { "baselineIdentifiers": ['arn:aws:controltower:us-east-1::baseline/17BSJV3IGJ2QSGA2', 'arn:aws:controltower:us-east-1::baseline/12GZU8CKZKVMS2AW'] }, "nextToken": "bde7-XX0c6fXXXXXX", "maxResults": 5 }
ListEnabledBaselines
輸入(僅限targetIdentifiers
過濾器):
{ "filter": { "targetIdentifiers": ['arn:aws:organizations::123456789012:ou/o-s9511vn103/ou-xqj7-fex1u317', 'arn:aws:organizations::123456789012:ou/o-s9511vn103/ou-xqj7-11q6n2cf'] }, "nextToken": "bde7-XX0c6fXXXXXX", "maxResults": 2 }
ListEnabledBaselines
輸入(baselineIdentifiers
和targetIdentifiers
過濾器):
{ "filter": { "baselineIdentifiers": ['arn:aws:controltower:us-east-1::baseline/17BSJV3IGJ2QSGA2'] "targetIdentifiers": ['arn:aws:organizations::123456789012:ou/o-s9511vn103/ou-xqj7-fex1u317'] }, "nextToken": "bde7-XX0c6fXXXXXX", "maxResults": 5 }
ListEnabledBaselines
輸出:
{ "enabledBaselines": [ { "arn": "arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XAHCR4CJTSI4W07MZ", "baselineIdentifier": "arn:aws:controltower:us-east-1::baseline:17BSJV3IGJ2QSGA2", "baselineVersion": "3.0", "targetIdentifier": "arn:aws:organizations::123456789012:ou/o-kgj0txdhpa/ou-r9mj-4j3mzjql", "statusSummary": { "status": "SUCCEEDED", "lastOperationIdentifier": "58f12232-26be-4735-a3e9-dd30d90f021f" } }, { "arn": "arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XAJ9NKW88AA4W9CLL", "baselineIdentifier": "arn:aws:controltower:us-east-1::baseline:17BSJV3IGJ2QSGA2", "baselineVersion": "4.0", "targetIdentifier": "arn:aws:organizations::123456789012:ou/o-s9511vn103/ou-xqj7-fex1u317", "statusSummary": { "status": "FAILED", "lastOperationIdentifier": "81e02df1-2b4d-48f0-838f-3833b93dcdc0" } } ], "nextToken": "e2bXXXXX6cab" }
CLI例如一種類型的過濾器(baselineIdentifiers
過濾器):
aws controltower list-enabled-baselines \ --filter baselineIdentifiers=arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2,arn:aws:controltower:us-west-2::baseline/LN25R72TTG6IGPTQ \ --region us-west-2
CLI使用多個過濾器(baselineIdentifiers
和過targetIdentifiers
濾器)的示例:
aws controltower list-enabled-baselines \ --filter targetIdentifiers=arn:aws:organizations::123456789012:ou/o-aq21sw43de5/ou-po90-lk87jh65,baselineIdentifiers=arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2 \ --region us-west-2
ResetEnabledBaseline
如需此API作業的詳細資訊,請參閱ResetEnabledBaseline。
ResetEnabledbaseline
輸入:
{ "enabledBaselineIdentifier": "arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAJ9NKW88AA4W9CLL" }
ResetEnabledBaseline
輸出:
{ "operationIdentifier": "81e02df1-2b4d-48f0-838f-3833b93dcdc0" }
ResetEnabledBaseline
CLI例如:
aws controltower reset-enabled-baseline \ --enabled-baseline-identifier arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHXS7P6C4I453EZC \ --region us-west-2
UpdateEnabledBaseline
如需此API作業的詳細資訊,請參閱UpdateEnabledBaseline。
UpdateEnabledBaseline
輸入:
{ "enabledBaselineIdentifier": "arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XAJ9NKW88AA4W9CLL", "baselineVersion": "4.0", "parameters": [ { "key": "IdentityCenterEnabledBaselineArn", "value": "arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XAHCR4CJTSI4W07MZ" } ] }
UpdateEnabledBaseline
輸出:
{ "operationIdentifier": "81e02df1-2b4d-48f0-838f-3833b93dcdc0" }
UpdateEnabledBaseline
CLI例如:
aws controltower update-enabled-baseline \ --enabled-baseline-identifier arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHXS7P6C4I453EZC \ --baseline-version 4.0 --parameters '[{"key":"IdentityCenterEnabledBaselineArn","value":"arn:aws:controltower:us-west-2:123456789012:enabledbaseline/XAHXS7P6C4I453EZC"}]' \ --region us-west-2