Control Tower
Prefix controltower, 65 actions · Domain Management & Governance
1 AWS managed policy. 0 have reviewed guidance; the rest have authoritative permission data pending editorial review.
Operator and limited (1)
Also grants Control Tower actions (11)
- AdministratorAccess
- AIDevOpsAgentActionsPolicy
- AWS_ConfigRole
- AWSCODAPermissionsBoundary
- AWSConfigServiceRolePolicy
- AWSMcpServiceActionsFullAccess
- AWSResourceExplorerServiceRolePolicy
- AWSSupportServiceRolePolicy
- AWSWellArchitectedAgentResourceScanningServiceRolePolicy
- PowerUserAccess
- WellArchitectedAgentResourceScanning
createlandingzone createmanagedaccount deletelandingzone deregistermanagedaccount deregisterorganizationalunit describeaccountfactoryconfig describecoreservice describeguardrail describeguardrailfortarget describelandingzoneconfiguration describemanagedaccount describemanagedorganizationalunit describeregisterorganizationalunitoperation describesinglesignon disablebaseline disablecontrol disableguardrail enablebaseline enablecontrol enableguardrail getaccountinfo getavailableupdates getbaseline getbaselineoperation getcontroloperation getenabledbaseline getenabledcontrol getguardrailcompliancestatus gethomeregion getlandingzone getlandingzonedriftstatus getlandingzoneoperation getlandingzonestatus listbaselines listcontroloperations listdirectorygroups listdriftdetails listenabledbaselines listenabledcontrols listenabledguardrails listextendgovernanceprecheckdetails listexternalconfigrulecompliance listguardrailviolations listguardrails listguardrailsfortarget listlandingzoneoperations listlandingzones listmanagedaccounts listmanagedaccountsforguardrail listmanagedaccountsforparent listmanagedorganizationalunits listmanagedorganizationalunitsforguardrail listtagsforresource manageorganizationalunit performprelaunchchecks resetenabledbaseline resetenabledcontrol resetlandingzone setuplandingzone tagresource untagresource updateaccountfactoryconfig updateenabledbaseline updateenabledcontrol updatelandingzone
Actions (65)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| controltower:CreateLandingZone | Write | 4 | 1 |
| controltower:CreateManagedAccount | Write | 4 | 1 |
| controltower:DeleteLandingZone | Write | 4 | 1 |
| controltower:DeregisterManagedAccount | Write | 4 | 1 |
| controltower:DeregisterOrganizationalUnit | Write | 4 | 1 |
| controltower:DescribeAccountFactoryConfig | Read | 5 | 1 |
| controltower:DescribeCoreService | Read | 5 | 1 |
| controltower:DescribeGuardrail | Read | 5 | 1 |
| controltower:DescribeGuardrailForTarget | Read | 5 | 1 |
| controltower:DescribeLandingZoneConfiguration | Read | 4 | 1 |
| controltower:DescribeManagedAccount | Read | 5 | 1 |
| controltower:DescribeManagedOrganizationalUnit | Read | 4 | 1 |
| controltower:DescribeRegisterOrganizationalUnitOperation | Read | 4 | 1 |
| controltower:DescribeSingleSignOn | Read | 5 | 1 |
| controltower:DisableBaseline | Write | 4 | 1 |
| controltower:DisableControl | Write | 4 | 1 |
| controltower:DisableGuardrail | Write | 4 | 1 |
| controltower:EnableBaseline | Write | 4 | 2 |
| controltower:EnableControl | Write | 4 | 2 |
| controltower:EnableGuardrail | Write | 4 | 1 |
| controltower:GetAccountInfo | Read | 5 | 1 |
| controltower:GetAvailableUpdates | Read | 6 | 1 |
| controltower:GetBaseline | Read | 5 | 2 |
| controltower:GetBaselineOperation | Read | 7 | 1 |
| controltower:GetControlOperation | Read | 7 | 1 |
| controltower:GetEnabledBaseline | Read | 7 | 3 |
| controltower:GetEnabledControl | Read | 7 | 3 |
| controltower:GetGuardrailComplianceStatus | Read | 5 | 1 |
| controltower:GetHomeRegion | Read | 6 | 1 |
| controltower:GetLandingZone | Read | 9 | 3 |
| controltower:GetLandingZoneDriftStatus | Read | 5 | 1 |
| controltower:GetLandingZoneOperation | Read | 5 | 1 |
| controltower:GetLandingZoneStatus | Read | 6 | 1 |
| controltower:ListBaselines | List | 7 | 1 |
| controltower:ListControlOperations | List | 5 | 1 |
| controltower:ListDirectoryGroups | List | 6 | 1 |
| controltower:ListDriftDetails | Read | 5 | 1 |
| controltower:ListEnabledBaselines | List | 8 | 2 |
| controltower:ListEnabledControls | List | 8 | 2 |
| controltower:ListEnabledGuardrails | List | 5 | 1 |
| controltower:ListExtendGovernancePrecheckDetails | List | 5 | 1 |
| controltower:ListExternalConfigRuleCompliance | Read | 5 | 1 |
| controltower:ListGuardrailViolations | List | 6 | 1 |
| controltower:ListGuardrails | List | 5 | 1 |
| controltower:ListGuardrailsForTarget | List | 6 | 1 |
| controltower:ListLandingZoneOperations | List | 5 | 1 |
| controltower:ListLandingZones | List | 10 | 2 |
| controltower:ListManagedAccounts | List | 6 | 1 |
| controltower:ListManagedAccountsForGuardrail | List | 6 | 1 |
| controltower:ListManagedAccountsForParent | List | 6 | 1 |
| controltower:ListManagedOrganizationalUnits | List | 6 | 1 |
| controltower:ListManagedOrganizationalUnitsForGuardrail | List | 6 | 1 |
| controltower:ListTagsForResource | Read | 6 | 3 |
| controltower:ManageOrganizationalUnit | Write | 4 | 1 |
| controltower:PerformPreLaunchChecks | Read | 4 | 1 |
| controltower:ResetEnabledBaseline | Write | 4 | 1 |
| controltower:ResetEnabledControl | Write | 4 | 1 |
| controltower:ResetLandingZone | Write | 4 | 1 |
| controltower:SetupLandingZone | Write | 4 | 1 |
| controltower:TagResource | Tagging | 4 | 2 |
| controltower:UntagResource | Tagging | 4 | 1 |
| controltower:UpdateAccountFactoryConfig | Write | 4 | 1 |
| controltower:UpdateEnabledBaseline | Write | 4 | 1 |
| controltower:UpdateEnabledControl | Write | 4 | 1 |
| controltower:UpdateLandingZone | Write | 4 | 1 |