AWS controltower documentation change
Summary
Added requirement to reset optional controls when re-registering OUs and provided CLI commands for resetting EnabledControl resources
Security assessment
The change enhances documentation for maintaining control consistency but does not reference a specific security vulnerability. Optional controls may include security configurations, so resetting them ensures security settings stay updated with the baseline.
Diff
diff --git a/controltower/latest/userguide/walkthrough-baseline-steps.md b/controltower/latest/userguide/walkthrough-baseline-steps.md index fb0291692..e53eafd5e 100644 --- a//controltower/latest/userguide/walkthrough-baseline-steps.md +++ b//controltower/latest/userguide/walkthrough-baseline-steps.md @@ -44 +44,5 @@ _If the Identity Center Baseline is not enabled, omit the`parameters` flag, as f -After you make updates to landing zone settings, or update your landing zone version, you must **Re-register** OUs to give them the latest changes. Follow these steps to re-register an OU programmatically, by resetting the associated `EnabledBaseline` resource. +After you make updates to landing zone settings, or update your landing zone version, you must **Re-register** OUs to give them the latest changes. Follow these steps to re-register an OU programmatically, by resetting the associated `EnabledBaseline` resource and any associated `EnabledControl` resources. + +###### Important + +If the OU has optional controls enabled, you must also call the [`ResetEnabledControl`](https://docs.aws.amazon.com//controltower/latest/APIReference/API_ResetEnabledControl.html) API for each enabled optional control after resetting the baseline. This step ensures that the optional controls remain consistent with the latest landing zone configuration. If you skip this step, optional controls on the OU may not reflect the latest landing zone changes. If you do not have any optional controls enabled, this step is not required. @@ -57,0 +62,12 @@ After you make updates to landing zone settings, or update your landing zone ver + 4. If the OU has optional controls enabled, list the enabled controls for the OU and reset each one so they remain consistent with the latest landing zone configuration. + +List the enabled controls on the target OU: + + aws controltower list-enabled-controls --target-identifier <OU ARN> + +For each enabled optional control returned, reset it by calling: + + aws controltower reset-enabled-control --enabled-control-identifier <EnabledControlArn> + +For more information, see [ResetEnabledControl](https://docs.aws.amazon.com//controltower/latest/APIReference/API_ResetEnabledControl.html) in the _AWS Control Tower API Reference_. +