published on Tuesday, Mar 10, 2026 by Pulumi
published on Tuesday, Mar 10, 2026 by Pulumi
Allows the application of pre-defined controls to organizational units. For more information on usage, please see the AWS Control Tower User Guide.
Example Usage
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
var current = Aws.GetRegion.Invoke();
var exampleOrganization = Aws.Organizations.GetOrganization.Invoke();
var exampleOrganizationalUnits = Aws.Organizations.GetOrganizationalUnits.Invoke(new()
{
ParentId = exampleOrganization.Apply(getOrganizationResult => getOrganizationResult.Roots[0]?.Id),
});
var exampleControlTowerControl = new Aws.ControlTower.ControlTowerControl("exampleControlTowerControl", new()
{
ControlIdentifier = $"arn:aws:controltower:{current.Apply(getRegionResult => getRegionResult.Name)}::control/AWS-GR_EC2_VOLUME_INUSE_CHECK",
TargetIdentifier = .Where(x => x.Name == "Infrastructure").Select(x =>
{
return x.Arn;
})[0],
});
});
package main
import (
"fmt"
"github.com/pulumi/pulumi-aws/sdk/v5/go/aws"
"github.com/pulumi/pulumi-aws/sdk/v5/go/aws/controltower"
"github.com/pulumi/pulumi-aws/sdk/v5/go/aws/organizations"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
current, err := aws.GetRegion(ctx, nil, nil)
if err != nil {
return err
}
exampleOrganization, err := organizations.LookupOrganization(ctx, nil, nil)
if err != nil {
return err
}
exampleOrganizationalUnits, err := organizations.GetOrganizationalUnits(ctx, &organizations.GetOrganizationalUnitsArgs{
ParentId: exampleOrganization.Roots[0].Id,
}, nil)
if err != nil {
return err
}
_, err = controltower.NewControlTowerControl(ctx, "exampleControlTowerControl", &controltower.ControlTowerControlArgs{
ControlIdentifier: pulumi.String(fmt.Sprintf("arn:aws:controltower:%v::control/AWS-GR_EC2_VOLUME_INUSE_CHECK", current.Name)),
TargetIdentifier: "TODO: For expression"[0],
})
if err != nil {
return err
}
return nil
})
}
Example coming soon!
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const current = aws.getRegion({});
const exampleOrganization = aws.organizations.getOrganization({});
const exampleOrganizationalUnits = exampleOrganization.then(exampleOrganization => aws.organizations.getOrganizationalUnits({
parentId: exampleOrganization.roots?.[0]?.id,
}));
const exampleControlTowerControl = new aws.controltower.ControlTowerControl("exampleControlTowerControl", {
controlIdentifier: current.then(current => `arn:aws:controltower:${current.name}::control/AWS-GR_EC2_VOLUME_INUSE_CHECK`),
targetIdentifier: exampleOrganizationalUnits.then(exampleOrganizationalUnits => .filter(x => x.name == "Infrastructure").map(x => (x.arn))[0]),
});
import pulumi
import pulumi_aws as aws
current = aws.get_region()
example_organization = aws.organizations.get_organization()
example_organizational_units = aws.organizations.get_organizational_units(parent_id=example_organization.roots[0].id)
example_control_tower_control = aws.controltower.ControlTowerControl("exampleControlTowerControl",
control_identifier=f"arn:aws:controltower:{current.name}::control/AWS-GR_EC2_VOLUME_INUSE_CHECK",
target_identifier=[x.arn for x in example_organizational_units.childrens if x.name == "Infrastructure"][0])
Example coming soon!
Create ControlTowerControl Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new ControlTowerControl(name: string, args: ControlTowerControlArgs, opts?: CustomResourceOptions);@overload
def ControlTowerControl(resource_name: str,
args: ControlTowerControlArgs,
opts: Optional[ResourceOptions] = None)
@overload
def ControlTowerControl(resource_name: str,
opts: Optional[ResourceOptions] = None,
control_identifier: Optional[str] = None,
target_identifier: Optional[str] = None)func NewControlTowerControl(ctx *Context, name string, args ControlTowerControlArgs, opts ...ResourceOption) (*ControlTowerControl, error)public ControlTowerControl(string name, ControlTowerControlArgs args, CustomResourceOptions? opts = null)
public ControlTowerControl(String name, ControlTowerControlArgs args)
public ControlTowerControl(String name, ControlTowerControlArgs args, CustomResourceOptions options)
type: aws:controltower:ControlTowerControl
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args ControlTowerControlArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args ControlTowerControlArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args ControlTowerControlArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args ControlTowerControlArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args ControlTowerControlArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var controlTowerControlResource = new Aws.ControlTower.ControlTowerControl("controlTowerControlResource", new()
{
ControlIdentifier = "string",
TargetIdentifier = "string",
});
example, err := controltower.NewControlTowerControl(ctx, "controlTowerControlResource", &controltower.ControlTowerControlArgs{
ControlIdentifier: pulumi.String("string"),
TargetIdentifier: pulumi.String("string"),
})
var controlTowerControlResource = new ControlTowerControl("controlTowerControlResource", ControlTowerControlArgs.builder()
.controlIdentifier("string")
.targetIdentifier("string")
.build());
control_tower_control_resource = aws.controltower.ControlTowerControl("controlTowerControlResource",
control_identifier="string",
target_identifier="string")
const controlTowerControlResource = new aws.controltower.ControlTowerControl("controlTowerControlResource", {
controlIdentifier: "string",
targetIdentifier: "string",
});
type: aws:controltower:ControlTowerControl
properties:
controlIdentifier: string
targetIdentifier: string
ControlTowerControl Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The ControlTowerControl resource accepts the following input properties:
- Control
Identifier string - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- Target
Identifier string - The ARN of the organizational unit.
- Control
Identifier string - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- Target
Identifier string - The ARN of the organizational unit.
- control
Identifier String - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- target
Identifier String - The ARN of the organizational unit.
- control
Identifier string - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- target
Identifier string - The ARN of the organizational unit.
- control_
identifier str - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- target_
identifier str - The ARN of the organizational unit.
- control
Identifier String - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- target
Identifier String - The ARN of the organizational unit.
Outputs
All input properties are implicitly available as output properties. Additionally, the ControlTowerControl resource produces the following output properties:
- Id string
- The provider-assigned unique ID for this managed resource.
- Id string
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
- id string
- The provider-assigned unique ID for this managed resource.
- id str
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
Look up Existing ControlTowerControl Resource
Get an existing ControlTowerControl resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: ControlTowerControlState, opts?: CustomResourceOptions): ControlTowerControl@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
control_identifier: Optional[str] = None,
target_identifier: Optional[str] = None) -> ControlTowerControlfunc GetControlTowerControl(ctx *Context, name string, id IDInput, state *ControlTowerControlState, opts ...ResourceOption) (*ControlTowerControl, error)public static ControlTowerControl Get(string name, Input<string> id, ControlTowerControlState? state, CustomResourceOptions? opts = null)public static ControlTowerControl get(String name, Output<String> id, ControlTowerControlState state, CustomResourceOptions options)resources: _: type: aws:controltower:ControlTowerControl get: id: ${id}- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Control
Identifier string - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- Target
Identifier string - The ARN of the organizational unit.
- Control
Identifier string - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- Target
Identifier string - The ARN of the organizational unit.
- control
Identifier String - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- target
Identifier String - The ARN of the organizational unit.
- control
Identifier string - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- target
Identifier string - The ARN of the organizational unit.
- control_
identifier str - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- target_
identifier str - The ARN of the organizational unit.
- control
Identifier String - The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
- target
Identifier String - The ARN of the organizational unit.
Import
Control Tower Controls can be imported using their organizational_unit_arn/control_identifier, e.g.,
$ pulumi import aws:controltower/controlTowerControl:ControlTowerControl example arn:aws:organizations::123456789101:ou/o-qqaejywet/ou-qg5o-ufbhdtv3,arn:aws:controltower:us-east-1::control/WTDSMKDKDNLE
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- AWS Classic pulumi/pulumi-aws
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
awsTerraform Provider.
published on Tuesday, Mar 10, 2026 by Pulumi
