AWS controltower documentation change

Service: controltower · 2025-06-13 · Documentation medium

File: controltower/latest/userguide/additional-console-required-permissions.md

Summary

Added new section 'View the Control Catalog in the console' with required controlcatalog IAM permissions and example policy

Security assessment

Documents new required permissions for accessing control catalog features but does not address a specific vulnerability. Enhances security awareness by specifying required IAM actions.

Diff

diff --git a/controltower/latest/userguide/additional-console-required-permissions.md b/controltower/latest/userguide/additional-console-required-permissions.md
index ad60b8945..b9b96700d 100644
--- a//controltower/latest/userguide/additional-console-required-permissions.md
+++ b//controltower/latest/userguide/additional-console-required-permissions.md
@@ -5 +5,3 @@
-# Permissions Required to Use the AWS Control Tower Console
+View the Control Catalog in the console
+
+# Permissions Required to use the AWS Control Tower console
@@ -9 +11 @@ AWS Control Tower creates three roles automatically when you set up a landing zo
-###### Three required roles
+###### Three required roles for landing zone access
@@ -21,0 +24,46 @@ We recommend that you restrict access to your role trust policies for these role
+## View the Control Catalog in the console
+
+To view control information in the AWS Control Tower console, you must add additional `controlcatalog` permissions to your IAM policies. These permissions are as follows:
+
+  * `controlcatalog:GetControl`
+
+  * `controlcatalog:ListControls`
+
+  * `controlcatalog:ListControlMappings`
+
+  * `controlcatalog:ListCommonControls`
+
+
+
+
+Here's an example showing the updated permissions in the policy.
+    
+    
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Action": [
+                    "controlcatalog:GetControl",
+                    "controlcatalog:ListControls",
+                    "controlcatalog:ListControlMappings",
+                    "controlcatalog:ListCommonControls"
+                ],
+                "Resource": [
+                    "*"
+                ],
+                "Effect": "Allow"
+            }
+        ]
+    }
+
+You must add these permissions because AWS Control Tower calls the `controlcatalog` APIs to retrieve certain control metadata, so the AWS Control Tower permissions are not sufficient.
+
+To find more information about how to update your permissions, see [Create roles and assign permissions](https://docs.aws.amazon.com/controltower/latest/userguide/assign-permissions.html).
+
+To find more information about `controlcatalog` IAM actions, see [Actions, resources, and condition keys for Control Catalog](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscontrolcatalog.html).
+
+###### Note
+
+Control information is available through the [Control Catalog APIs](https://docs.aws.amazon.com/controlcatalog/latest/APIReference/Welcome.html).
+