Docs Home
AWS v6.81.0 published on Tuesday, May 20, 2025 by Pulumi
aws.controltower.ControlTowerControl
Explore with Pulumi AI
Allows the application of pre-defined controls to organizational units. For more information on usage, please see the AWS Control Tower User Guide.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const current = aws.getRegion({});
const example = aws.organizations.getOrganization({});
const exampleGetOrganizationalUnits = example.then(example => aws.organizations.getOrganizationalUnits({
parentId: example.roots?.[0]?.id,
}));
const exampleControlTowerControl = new aws.controltower.ControlTowerControl("example", {
controlIdentifier: current.then(current => `arn:aws:controltower:${current.name}::control/AWS-GR_EC2_VOLUME_INUSE_CHECK`),
targetIdentifier: exampleGetOrganizationalUnits.then(exampleGetOrganizationalUnits => .filter(x => x.name == "Infrastructure").map(x => (x.arn))[0]),
parameters: [{
key: "AllowedRegions",
value: JSON.stringify(["us-east-1"]),
}],
});
import pulumi
import json
import pulumi_aws as aws
current = aws.get_region()
example = aws.organizations.get_organization()
example_get_organizational_units = aws.organizations.get_organizational_units(parent_id=example.roots[0].id)
example_control_tower_control = aws.controltower.ControlTowerControl("example",
control_identifier=f"arn:aws:controltower:{current.name}::control/AWS-GR_EC2_VOLUME_INUSE_CHECK",
target_identifier=[x.arn for x in example_get_organizational_units.children if x.name == "Infrastructure"][0],
parameters=[{
"key": "AllowedRegions",
"value": json.dumps(["us-east-1"]),
}])
Coming soon!
using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
var current = Aws.GetRegion.Invoke();
var example = Aws.Organizations.GetOrganization.Invoke();
var exampleGetOrganizationalUnits = Aws.Organizations.GetOrganizationalUnits.Invoke(new()
{
ParentId = example.Apply(getOrganizationResult => getOrganizationResult.Roots[0]?.Id),
});
var exampleControlTowerControl = new Aws.ControlTower.ControlTowerControl("example", new()
{
ControlIdentifier = $"arn:aws:controltower:{current.Apply(getRegionResult => getRegionResult.Name)}::control/AWS-GR_EC2_VOLUME_INUSE_CHECK",
TargetIdentifier = .Where(x => x.Name == "Infrastructure").Select(x =>
{
return x.Arn;
}).ToList()[0],
Parameters = new[]
{
new Aws.ControlTower.Inputs.ControlTowerControlParameterArgs
{
Key = "AllowedRegions",
Value = JsonSerializer.Serialize(new[]
{
"us-east-1",
}),
},
},
});
});
Coming soon!
Coming soon!
Create ControlTowerControl Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new ControlTowerControl(name: string, args: ControlTowerControlArgs, opts?: CustomResourceOptions);@overload
def ControlTowerControl(resource_name: str,
args: ControlTowerControlArgs,
opts: Optional[ResourceOptions] = None)
@overload
def ControlTowerControl(resource_name: str,
opts: Optional[ResourceOptions] = None,
control_identifier: Optional[str] = None,
target_identifier: Optional[str] = None,
parameters: Optional[Sequence[ControlTowerControlParameterArgs]] = None)func NewControlTowerControl(ctx *Context, name string, args ControlTowerControlArgs, opts ...ResourceOption) (*ControlTowerControl, error)public ControlTowerControl(string name, ControlTowerControlArgs args, CustomResourceOptions? opts = null)
public ControlTowerControl(String name, ControlTowerControlArgs args)
public ControlTowerControl(String name, ControlTowerControlArgs args, CustomResourceOptions options)
type: aws:controltower:ControlTowerControl
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args ControlTowerControlArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args ControlTowerControlArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args ControlTowerControlArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args ControlTowerControlArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args ControlTowerControlArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var controlTowerControlResource = new Aws.ControlTower.ControlTowerControl("controlTowerControlResource", new()
{
ControlIdentifier = "string",
TargetIdentifier = "string",
Parameters = new[]
{
new Aws.ControlTower.Inputs.ControlTowerControlParameterArgs
{
Key = "string",
Value = "string",
},
},
});
example, err := controltower.NewControlTowerControl(ctx, "controlTowerControlResource", &controltower.ControlTowerControlArgs{
ControlIdentifier: pulumi.String("string"),
TargetIdentifier: pulumi.String("string"),
Parameters: controltower.ControlTowerControlParameterArray{
&controltower.ControlTowerControlParameterArgs{
Key: pulumi.String("string"),
Value: pulumi.String("string"),
},
},
})
var controlTowerControlResource = new ControlTowerControl("controlTowerControlResource", ControlTowerControlArgs.builder()
.controlIdentifier("string")
.targetIdentifier("string")
.parameters(ControlTowerControlParameterArgs.builder()
.key("string")
.value("string")
.build())
.build());
control_tower_control_resource = aws.controltower.ControlTowerControl("controlTowerControlResource",
control_identifier="string",
target_identifier="string",
parameters=[{
"key": "string",
"value": "string",
}])
const controlTowerControlResource = new aws.controltower.ControlTowerControl("controlTowerControlResource", {
controlIdentifier: "string",
targetIdentifier: "string",
parameters: [{
key: "string",
value: "string",
}],
});
type: aws:controltower:ControlTowerControl
properties:
controlIdentifier: string
parameters:
- key: string
value: string
targetIdentifier: string
ControlTowerControl Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The ControlTowerControl resource accepts the following input properties:
- Control
Identifier string - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- Target
Identifier string The ARN of the organizational unit.
The following arguments are optional:
- Parameters
List<Control
Tower Control Parameter> - Parameter values which are specified to configure the control when you enable it. See Parameters for more details.
- Control
Identifier string - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- Target
Identifier string The ARN of the organizational unit.
The following arguments are optional:
- Parameters
[]Control
Tower Control Parameter Args - Parameter values which are specified to configure the control when you enable it. See Parameters for more details.
- control
Identifier String - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- target
Identifier String The ARN of the organizational unit.
The following arguments are optional:
- parameters
List<Control
Tower Control Parameter> - Parameter values which are specified to configure the control when you enable it. See Parameters for more details.
- control
Identifier string - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- target
Identifier string The ARN of the organizational unit.
The following arguments are optional:
- parameters
Control
Tower Control Parameter[] - Parameter values which are specified to configure the control when you enable it. See Parameters for more details.
- control_
identifier str - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- target_
identifier str The ARN of the organizational unit.
The following arguments are optional:
- parameters
Sequence[Control
Tower Control Parameter Args] - Parameter values which are specified to configure the control when you enable it. See Parameters for more details.
- control
Identifier String - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- target
Identifier String The ARN of the organizational unit.
The following arguments are optional:
- parameters List<Property Map>
- Parameter values which are specified to configure the control when you enable it. See Parameters for more details.
Outputs
All input properties are implicitly available as output properties. Additionally, the ControlTowerControl resource produces the following output properties:
Look up Existing ControlTowerControl Resource
Get an existing ControlTowerControl resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: ControlTowerControlState, opts?: CustomResourceOptions): ControlTowerControl@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
arn: Optional[str] = None,
control_identifier: Optional[str] = None,
parameters: Optional[Sequence[ControlTowerControlParameterArgs]] = None,
target_identifier: Optional[str] = None) -> ControlTowerControlfunc GetControlTowerControl(ctx *Context, name string, id IDInput, state *ControlTowerControlState, opts ...ResourceOption) (*ControlTowerControl, error)public static ControlTowerControl Get(string name, Input<string> id, ControlTowerControlState? state, CustomResourceOptions? opts = null)public static ControlTowerControl get(String name, Output<String> id, ControlTowerControlState state, CustomResourceOptions options)resources: _: type: aws:controltower:ControlTowerControl get: id: ${id}- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Arn string
- The ARN of the EnabledControl resource.
- Control
Identifier string - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- Parameters
List<Control
Tower Control Parameter> - Parameter values which are specified to configure the control when you enable it. See Parameters for more details.
- Target
Identifier string The ARN of the organizational unit.
The following arguments are optional:
- Arn string
- The ARN of the EnabledControl resource.
- Control
Identifier string - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- Parameters
[]Control
Tower Control Parameter Args - Parameter values which are specified to configure the control when you enable it. See Parameters for more details.
- Target
Identifier string The ARN of the organizational unit.
The following arguments are optional:
- arn String
- The ARN of the EnabledControl resource.
- control
Identifier String - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- parameters
List<Control
Tower Control Parameter> - Parameter values which are specified to configure the control when you enable it. See Parameters for more details.
- target
Identifier String The ARN of the organizational unit.
The following arguments are optional:
- arn string
- The ARN of the EnabledControl resource.
- control
Identifier string - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- parameters
Control
Tower Control Parameter[] - Parameter values which are specified to configure the control when you enable it. See Parameters for more details.
- target
Identifier string The ARN of the organizational unit.
The following arguments are optional:
- arn str
- The ARN of the EnabledControl resource.
- control_
identifier str - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- parameters
Sequence[Control
Tower Control Parameter Args] - Parameter values which are specified to configure the control when you enable it. See Parameters for more details.
- target_
identifier str The ARN of the organizational unit.
The following arguments are optional:
- arn String
- The ARN of the EnabledControl resource.
- control
Identifier String - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- parameters List<Property Map>
- Parameter values which are specified to configure the control when you enable it. See Parameters for more details.
- target
Identifier String The ARN of the organizational unit.
The following arguments are optional:
Supporting Types
ControlTowerControlParameter, ControlTowerControlParameterArgs
Import
Using pulumi import, import Control Tower Controls using their organizational_unit_arn/control_identifier. For example:
$ pulumi import aws:controltower/controlTowerControl:ControlTowerControl example arn:aws:organizations::123456789101:ou/o-qqaejywet/ou-qg5o-ufbhdtv3,arn:aws:controltower:us-east-1::control/WTDSMKDKDNLE
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- AWS Classic pulumi/pulumi-aws
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
awsTerraform Provider.