EnabledControl

Source: src/AWS/ControlTower/EnabledControl.ts

An AWS Control Tower control (guardrail) enabled on an organizational unit. Enabling a control starts an asynchronous operation that deploys governance resources (SCPs, Config rules, or hooks) to the OU and the accounts it contains.

Requires an AWS Control Tower landing zone and can only be managed from the Organizations management account.

Enabling Controls

Enable a preventive guardrail on an OU

import * as ControlTower from "alchemy/AWS/ControlTower";

const encryptedVolumes = yield* ControlTower.EnabledControl("EncryptedVolumes", {
  controlIdentifier:
    "arn:aws:controltower:us-west-2::control/AWS-GR_ENCRYPTED_VOLUMES",
  targetIdentifier: "arn:aws:organizations::111122223333:ou/o-example/ou-example",
});

Enable a configurable control with parameters

const regionDeny = yield* ControlTower.EnabledControl("RegionDeny", {
  controlIdentifier:
    "arn:aws:controlcatalog:::control/50utmyu7yqmhr8fpnpo8bnaj1",
  targetIdentifier: ouArn,
  parameters: [
    { key: "AllowedRegions", value: ["us-east-1", "us-west-2"] },
  ],
});