AWS cli medium security documentation change

Service: cli · 2025-11-10 · Security-related medium

File: cli/latest/reference/controltower/get-landing-zone.md

Summary

Updated landing zone structure documentation with new fields (version, remediationTypes), modified validation patterns, and added INHERITANCE_DRIFT drift type

Security assessment

Added 'remediationTypes' field describing automatic drift correction and compliance enforcement capabilities. The INHERITANCE_DRIFT type suggests new drift detection mechanisms for security configurations. These changes address security posture management through improved drift detection and remediation documentation.

Diff

diff --git a/cli/latest/reference/controltower/get-landing-zone.md b/cli/latest/reference/controltower/get-landing-zone.md
index 47f41dec5..6b54cc527 100644
--- a//cli/latest/reference/controltower/get-landing-zone.md
+++ b//cli/latest/reference/controltower/get-landing-zone.md
@@ -15 +15 @@
-  * [AWS CLI 2.31.31 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.32 Command Reference](../../index.html) »
@@ -201 +201 @@ landingZone -> (structure)
-> arn -> (string)
+> version -> (string) [required]
@@ -203 +203 @@ landingZone -> (structure)
->> The ARN of the landing zone.
+>> The landing zone’s current deployed version.
@@ -207,3 +207,3 @@ landingZone -> (structure)
->>   * min: `20`
->>   * max: `2048`
->>   * pattern: `^arn:aws[0-9a-zA-Z_\-:\/]+$`
+>>   * min: `3`
+>>   * max: `10`
+>>   * pattern: `\d+.\d+`
@@ -213 +213 @@ landingZone -> (structure)
-> driftStatus -> (structure)
+> manifest -> (document) [required]
@@ -215 +215,5 @@ landingZone -> (structure)
->> The drift status of the landing zone.
+>> The landing zone manifest JSON text file that specifies the landing zone configurations.
+> 
+> remediationTypes -> (list)
+>
+>> The types of remediation actions configured for the landing zone, such as automatic drift correction or compliance enforcement.
@@ -217 +221,4 @@ landingZone -> (structure)
->> status -> (string)
+>> Constraints:
+>> 
+>>   * min: `1`
+>>   * max: `1`
@@ -219,7 +225,0 @@ landingZone -> (structure)
->>> The drift status of the landing zone.
->>> 
->>> Valid values:
->>> 
->>>   * `DRIFTED` : The landing zone deployed in this configuration does not match the configuration that Amazon Web Services Control Tower expected.
->>>   * `IN_SYNC` : The landing zone deployed in this configuration matches the configuration that Amazon Web Services Control Tower expected.
->>> 
@@ -227 +227,3 @@ landingZone -> (structure)
->>> 
+>> 
+>> (string)
+>>
@@ -230,2 +232 @@ landingZone -> (structure)
->>>   * `DRIFTED`
->>>   * `IN_SYNC`
+>>>   * `INHERITANCE_DRIFT`
@@ -235 +236 @@ landingZone -> (structure)
-> latestAvailableVersion -> (string)
+> arn -> (string)
@@ -237 +238 @@ landingZone -> (structure)
->> The latest available version of the landing zone.
+>> The ARN of the landing zone.
@@ -241,3 +242,3 @@ landingZone -> (structure)
->>   * min: `3`
->>   * max: `10`
->>   * pattern: `^\d+.\d+$`
+>>   * min: `20`
+>>   * max: `2048`
+>>   * pattern: `arn:aws[0-9a-zA-Z_\-:\/]+`
@@ -246,4 +246,0 @@ landingZone -> (structure)
-> 
-> manifest -> (document) [required]
->
->> The landing zone manifest JSON text file that specifies the landing zone configurations.
@@ -263 +260 @@ landingZone -> (structure)
-> version -> (string) [required]
+> latestAvailableVersion -> (string)
@@ -265 +262 @@ landingZone -> (structure)
->> The landing zone’s current deployed version.
+>> The latest available version of the landing zone.
@@ -271 +268,7 @@ landingZone -> (structure)
->>   * pattern: `^\d+.\d+$`
+>>   * pattern: `\d+.\d+`
+>> 
+
+> 
+> driftStatus -> (structure)
+>
+>> The drift status of the landing zone.
@@ -272,0 +276,16 @@ landingZone -> (structure)
+>> status -> (string)
+>>
+>>> The drift status of the landing zone.
+>>> 
+>>> Valid values:
+>>> 
+>>>   * `DRIFTED` : The landing zone deployed in this configuration does not match the configuration that Amazon Web Services Control Tower expected.
+>>>   * `IN_SYNC` : The landing zone deployed in this configuration matches the configuration that Amazon Web Services Control Tower expected.
+>>> 
+
+>>> 
+>>> Possible values:
+>>> 
+>>>   * `DRIFTED`
+>>>   * `IN_SYNC`
+>>> 
@@ -285 +304 @@ landingZone -> (structure)
-  * [AWS CLI 2.31.31 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.32 Command Reference](../../index.html) »