AWS controltower documentation change
Summary
Added note about auto-enroll exceptions for moved accounts and linked ResetEnabledBaseline API documentation
Security assessment
The change clarifies drift resolution procedures and adds API references but does not address a specific security vulnerability or weakness. The mention of auto-enroll is operational, not security-focused.
Diff
diff --git a/controltower/latest/userguide/resolving-drift.md b/controltower/latest/userguide/resolving-drift.md index 7e590679b..911fe0990 100644 --- a//controltower/latest/userguide/resolving-drift.md +++ b//controltower/latest/userguide/resolving-drift.md @@ -7 +7 @@ -Although detection is automatic, the steps to resolve drift must be done manually through the console, or with the APIs. +Although detection is automatic, the steps to resolve drift must be done manually through the console, or with the APIs. (Except in certain cases when auto-enroll is enabled for accounts that are moved.) @@ -23 +23 @@ To resolve _configuration baseline drift_ for an OU, you can choose **Re-registe - * Baseline drift on OUs and accounts can be resolved by calling the **ResetEnabledBaseline** API, or by choosing **Re-register OU** or **Update account** in the AWS Control Tower console. + * Baseline drift on OUs and accounts can be resolved by calling the [`ResetEnabledBaseline`](https://docs.aws.amazon.com/controltower/latest/APIReference/API_ResetEnabledBaseline.html) API, or by choosing **Re-register OU** or **Update account** in the AWS Control Tower console.