AWS.ControlTower reference

EnabledBaseline

Source: src/AWS/ControlTower/EnabledBaseline.ts

An AWS Control Tower baseline enabled on a target organizational unit. Enabling a baseline (e.g. AWSControlTowerBaseline) starts an asynchronous operation that registers the OU with Control Tower and deploys the baseline’s governance resources to its accounts.

Requires an AWS Control Tower landing zone and can only be managed from the Organizations management account.

EnabledBaseline: Enabling Baselines

Register an OU with Control Tower

import * as ControlTower from "alchemy/AWS/ControlTower";

const enabled = yield* ControlTower.EnabledBaseline("WorkloadsBaseline", {
  baselineIdentifier:
    "arn:aws:controltower:us-west-2::baseline/17BSJV3IGJ2QSGA2",
  baselineVersion: "4.0",
  targetIdentifier: "arn:aws:organizations::111122223333:ou/o-example/ou-example",
});

Baseline with Identity Center parameter

const enabled = yield* ControlTower.EnabledBaseline("WorkloadsBaseline", {
  baselineIdentifier: controlTowerBaselineArn,
  baselineVersion: "4.0",
  targetIdentifier: ouArn,
  parameters: [
    {
      key: "IdentityCenterEnabledBaselineArn",
      value: identityCenterEnabledBaselineArn,
    },
  ],
});

EnabledControl

Source: src/AWS/ControlTower/EnabledControl.ts

An AWS Control Tower control (guardrail) enabled on an organizational unit. Enabling a control starts an asynchronous operation that deploys governance resources (SCPs, Config rules, or hooks) to the OU and the accounts it contains.

Requires an AWS Control Tower landing zone and can only be managed from the Organizations management account.

EnabledControl: Enabling Controls

Enable a preventive guardrail on an OU

import * as ControlTower from "alchemy/AWS/ControlTower";

const encryptedVolumes = yield* ControlTower.EnabledControl("EncryptedVolumes", {
  controlIdentifier:
    "arn:aws:controltower:us-west-2::control/AWS-GR_ENCRYPTED_VOLUMES",
  targetIdentifier: "arn:aws:organizations::111122223333:ou/o-example/ou-example",
});

Enable a configurable control with parameters

const regionDeny = yield* ControlTower.EnabledControl("RegionDeny", {
  controlIdentifier:
    "arn:aws:controlcatalog:::control/50utmyu7yqmhr8fpnpo8bnaj1",
  targetIdentifier: ouArn,
  parameters: [
    { key: "AllowedRegions", value: ["us-east-1", "us-west-2"] },
  ],
});

GetBaseline

Source: src/AWS/ControlTower/GetBaseline.ts

Runtime binding for controltower:GetBaseline.

An account-level operation that reads one entry of the Control Tower baseline catalog by its ARN — its name and description. Provide the implementation with Effect.provide(AWS.ControlTower.GetBaselineHttp).

GetBaseline: Browsing the Baseline Catalog

// init — account-level binding takes no resource
const getBaseline = yield* AWS.ControlTower.GetBaseline();

// runtime
const baseline = yield* getBaseline({ baselineIdentifier: baselineArn });
console.log(baseline.name, baseline.description);

GetBaselineOperation

Source: src/AWS/ControlTower/GetBaselineOperation.ts

Runtime binding for controltower:GetBaselineOperation.

An account-level operation that reads the status of an asynchronous baseline operation (ENABLE_BASELINE, DISABLE_BASELINE, UPDATE_ENABLED_BASELINE, RESET_ENABLED_BASELINE). Pair it with ResetEnabledBaseline to poll a drift-remediation run to completion. Provide the implementation with Effect.provide(AWS.ControlTower.GetBaselineOperationHttp).

GetBaselineOperation: Polling Asynchronous Operations

// init — account-level binding takes no resource
const getBaselineOperation = yield* AWS.ControlTower.GetBaselineOperation();

// runtime
const { baselineOperation } = yield* getBaselineOperation({
  operationIdentifier,
});
console.log(baselineOperation.status);

GetControlOperation

Source: src/AWS/ControlTower/GetControlOperation.ts

Runtime binding for controltower:GetControlOperation.

An account-level operation that reads the status of an asynchronous control operation (ENABLE_CONTROL, DISABLE_CONTROL, UPDATE_ENABLED_CONTROL, RESET_ENABLED_CONTROL). Pair it with ResetEnabledControl to poll a drift-remediation run to completion. Provide the implementation with Effect.provide(AWS.ControlTower.GetControlOperationHttp).

GetControlOperation: Polling Asynchronous Operations

// init — account-level binding takes no resource
const getControlOperation = yield* AWS.ControlTower.GetControlOperation();

// runtime
const { controlOperation } = yield* getControlOperation({
  operationIdentifier,
});
console.log(controlOperation.status);

GetEnabledBaseline

Source: src/AWS/ControlTower/GetEnabledBaseline.ts

Runtime binding for controltower:GetEnabledBaseline.

Bind this operation to an EnabledBaseline to read the enablement’s live status, drift status, and parameters from inside a function runtime. Provide the implementation with Effect.provide(AWS.ControlTower.GetEnabledBaselineHttp).

GetEnabledBaseline: Inspecting an Enabled Baseline

// init — bind the operation to the enabled baseline
const getEnabledBaseline = yield* AWS.ControlTower.GetEnabledBaseline(ouBaseline);

// runtime
const { enabledBaselineDetails } = yield* getEnabledBaseline();
console.log(enabledBaselineDetails?.statusSummary.status);

GetEnabledControl

Source: src/AWS/ControlTower/GetEnabledControl.ts

Runtime binding for controltower:GetEnabledControl.

Bind this operation to an EnabledControl to read the enablement’s live status, drift status, and parameters from inside a function runtime. Useful for drift-monitoring functions that alert when a guardrail drifts. Provide the implementation with Effect.provide(AWS.ControlTower.GetEnabledControlHttp).

GetEnabledControl: Inspecting an Enabled Control

// init — bind the operation to the enabled control
const getEnabledControl = yield* AWS.ControlTower.GetEnabledControl(guardrail);

// runtime
const { enabledControlDetails } = yield* getEnabledControl();
console.log(enabledControlDetails.driftStatusSummary?.driftStatus);

GetLandingZone

Source: src/AWS/ControlTower/GetLandingZone.ts

Runtime binding for controltower:GetLandingZone.

An account-level operation that reads the landing zone’s version, status, drift status, and manifest by its ARN (discovered via ListLandingZones). Useful for drift-monitoring functions that alert when the landing zone drifts out of sync. Provide the implementation with Effect.provide(AWS.ControlTower.GetLandingZoneHttp).

GetLandingZone: Inspecting the Landing Zone

// init — account-level binding takes no resource
const getLandingZone = yield* AWS.ControlTower.GetLandingZone();

// runtime
const { landingZone } = yield* getLandingZone({
  landingZoneIdentifier: arn,
});
console.log(landingZone.driftStatus?.status);

GetLandingZoneOperation

Source: src/AWS/ControlTower/GetLandingZoneOperation.ts

Runtime binding for controltower:GetLandingZoneOperation.

An account-level operation that reads the status of an asynchronous landing zone operation (CREATE, UPDATE, DELETE, RESET). Pair it with ResetLandingZone to poll a drift-remediation run to completion. Provide the implementation with Effect.provide(AWS.ControlTower.GetLandingZoneOperationHttp).

GetLandingZoneOperation: Polling Asynchronous Operations

// init — account-level binding takes no resource
const getLandingZoneOperation =
  yield* AWS.ControlTower.GetLandingZoneOperation();

// runtime
const { operationDetails } = yield* getLandingZoneOperation({
  operationIdentifier,
});
console.log(operationDetails.status);

LandingZone

Source: src/AWS/ControlTower/LandingZone.ts

An AWS Control Tower landing zone — the org-wide multi-account environment (organization structure, governed regions, centralized logging, and access management) that Control Tower governs.

A landing zone is a singleton per AWS Organization and can only be managed from the Organizations management account. Creating, updating, and decommissioning a landing zone are asynchronous operations that can take an hour or more.

LandingZone: Creating a Landing Zone

import * as ControlTower from "alchemy/AWS/ControlTower";

const landingZone = yield* ControlTower.LandingZone("LandingZone", {
  version: "3.3",
  manifest: {
    governedRegions: ["us-east-1", "us-west-2"],
    organizationStructure: {
      security: { name: "Security" },
      sandbox: { name: "Sandbox" },
    },
    centralizedLogging: {
      accountId: "111122223333",
      configurations: {
        loggingBucket: { retentionDays: 365 },
        accessLoggingBucket: { retentionDays: 365 },
      },
      enabled: true,
    },
    securityRoles: { accountId: "444455556666" },
    accessManagement: { enabled: true },
  },
});

LandingZone: Upgrading

const landingZone = yield* ControlTower.LandingZone("LandingZone", {
  version: "3.3", // bump to upgrade in place
  manifest,
});

ListBaselines

Source: src/AWS/ControlTower/ListBaselines.ts

Runtime binding for controltower:ListBaselines.

An account-level operation that enumerates the Control Tower baseline catalog (e.g. AWSControlTowerBaseline, AuditBaseline, LogArchiveBaseline). Useful for governance functions that discover the baseline ARN to enable on an organizational unit. Provide the implementation with Effect.provide(AWS.ControlTower.ListBaselinesHttp).

ListBaselines: Browsing the Baseline Catalog

// init — account-level binding takes no resource
const listBaselines = yield* AWS.ControlTower.ListBaselines();

// runtime
const result = yield* listBaselines();
const ouBaseline = result.baselines.find(
  (b) => b.name === "AWSControlTowerBaseline",
);

ListControlOperations

Source: src/AWS/ControlTower/ListControlOperations.ts

Runtime binding for controltower:ListControlOperations.

An account-level operation that enumerates recent control operations (enables, disables, updates, and resets), optionally filtered by status, control, or target. Useful for governance dashboards that surface in-flight or failed guardrail deployments. Provide the implementation with Effect.provide(AWS.ControlTower.ListControlOperationsHttp).

ListControlOperations: Polling Asynchronous Operations

// init — account-level binding takes no resource
const listControlOperations = yield* AWS.ControlTower.ListControlOperations();

// runtime
const result = yield* listControlOperations({
  filter: { statuses: ["FAILED"] },
});
console.log(result.controlOperations.length);

ListEnabledBaselines

Source: src/AWS/ControlTower/ListEnabledBaselines.ts

Runtime binding for controltower:ListEnabledBaselines.

An account-level operation that enumerates the baselines enabled across the organization’s targets, optionally filtered by target or baseline identifiers. Useful for compliance dashboards that report which OUs are registered with Control Tower. Provide the implementation with Effect.provide(AWS.ControlTower.ListEnabledBaselinesHttp).

ListEnabledBaselines: Auditing Enablements

// init — account-level binding takes no resource
const listEnabledBaselines = yield* AWS.ControlTower.ListEnabledBaselines();

// runtime
const result = yield* listEnabledBaselines({
  filter: { targetIdentifiers: [ouArn] },
});
const statuses = result.enabledBaselines.map(
  (b) => b.statusSummary.status,
);

ListEnabledControls

Source: src/AWS/ControlTower/ListEnabledControls.ts

Runtime binding for controltower:ListEnabledControls.

An account-level operation that enumerates the controls (guardrails) enabled on an organizational unit — or, with a filter, across the whole organization. Useful for compliance dashboards and drift-detection functions. Provide the implementation with Effect.provide(AWS.ControlTower.ListEnabledControlsHttp).

ListEnabledControls: Auditing Enablements

// init — account-level binding takes no resource
const listEnabledControls = yield* AWS.ControlTower.ListEnabledControls();

// runtime
const result = yield* listEnabledControls({ targetIdentifier: ouArn });
const drifted = result.enabledControls.filter(
  (c) => c.driftStatusSummary?.driftStatus === "DRIFTED",
);

ListLandingZoneOperations

Source: src/AWS/ControlTower/ListLandingZoneOperations.ts

Runtime binding for controltower:ListLandingZoneOperations.

An account-level operation that enumerates recent landing zone operations (creates, updates, deletes, and resets), optionally filtered by type or status. Useful for governance dashboards that surface in-flight landing zone upgrades. Provide the implementation with Effect.provide(AWS.ControlTower.ListLandingZoneOperationsHttp).

ListLandingZoneOperations: Polling Asynchronous Operations

// init — account-level binding takes no resource
const listLandingZoneOperations =
  yield* AWS.ControlTower.ListLandingZoneOperations();

// runtime
const result = yield* listLandingZoneOperations({
  filter: { statuses: ["IN_PROGRESS"] },
});
console.log(result.landingZoneOperations.length);

ListLandingZones

Source: src/AWS/ControlTower/ListLandingZones.ts

Runtime binding for controltower:ListLandingZones.

An account-level operation that returns the organization’s landing zone ARN (a landing zone is a singleton — the list has at most one entry). Useful for governance functions that discover the landing zone before reading its drift status. Provide the implementation with Effect.provide(AWS.ControlTower.ListLandingZonesHttp).

ListLandingZones: Inspecting the Landing Zone

// init — account-level binding takes no resource
const listLandingZones = yield* AWS.ControlTower.ListLandingZones();

// runtime
const result = yield* listLandingZones();
const arn = result.landingZones[0]?.arn;

ResetEnabledBaseline

Source: src/AWS/ControlTower/ResetEnabledBaseline.ts

Runtime binding for controltower:ResetEnabledBaseline.

Bind this operation to an EnabledBaseline to re-enroll the target with its baseline from inside a function runtime — remediating drift without changing the enablement’s configuration. The call starts an asynchronous operation; poll it with GetBaselineOperation. Provide the implementation with Effect.provide(AWS.ControlTower.ResetEnabledBaselineHttp).

ResetEnabledBaseline: Remediating Drift

// init — bind the operation to the enabled baseline
const resetEnabledBaseline = yield* AWS.ControlTower.ResetEnabledBaseline(ouBaseline);

// runtime
const { operationIdentifier } = yield* resetEnabledBaseline();

ResetEnabledControl

Source: src/AWS/ControlTower/ResetEnabledControl.ts

Runtime binding for controltower:ResetEnabledControl.

Bind this operation to an EnabledControl to re-deploy the guardrail’s governance resources from inside a function runtime — remediating drift without changing the enablement’s configuration. The call starts an asynchronous operation; poll it with GetControlOperation. Provide the implementation with Effect.provide(AWS.ControlTower.ResetEnabledControlHttp).

ResetEnabledControl: Remediating Drift

// init — bind the operation to the enabled control
const resetEnabledControl = yield* AWS.ControlTower.ResetEnabledControl(guardrail);

// runtime
const { operationIdentifier } = yield* resetEnabledControl();

ResetLandingZone

Source: src/AWS/ControlTower/ResetLandingZone.ts

Runtime binding for controltower:ResetLandingZone.

Bind this operation to a LandingZone to re-deploy the landing zone to its last-known configuration from inside a function runtime — remediating landing zone drift. The call starts an asynchronous operation (landing zone operations routinely take an hour); poll it with GetLandingZoneOperation. Provide the implementation with Effect.provide(AWS.ControlTower.ResetLandingZoneHttp).

ResetLandingZone: Remediating Drift

// init — bind the operation to the landing zone
const resetLandingZone = yield* AWS.ControlTower.ResetLandingZone(landingZone);

// runtime
const { operationIdentifier } = yield* resetLandingZone();