AWS controltower: Fix broken documentation links for legacy security controls

Service: controltower · 2026-08-19 · Documentation low

File: controltower/latest/controlreference/identifiers-for-legacy-controls.md

Summary

Corrected URLs in legacy control references by removing extra slashes to resolve broken links.

Security assessment

The change fixes broken URLs but does not alter security content, add new documentation, or reference vulnerabilities. It ensures links to existing controls work correctly.

Evidence

-  * [arn:aws:controltower:REGION::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED](https://docs.aws.amazon.com//controltower/latest/userguide/elective-controls.html#log-archive-encryption-enabled)

Diff

diff --git a/controltower/latest/controlreference/identifiers-for-legacy-controls.md b/controltower/latest/controlreference/identifiers-for-legacy-controls.md
index e10d6d875..be8cb3f86 100644
--- a//controltower/latest/controlreference/identifiers-for-legacy-controls.md
+++ b//controltower/latest/controlreference/identifiers-for-legacy-controls.md
@@ -19 +19 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED](https://docs.aws.amazon.com//controltower/latest/userguide/elective-controls.html#log-archive-encryption-enabled)
+  * [arn:aws:controltower:REGION::control/AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED](https://docs.aws.amazon.com/controltower/latest/userguide/elective-controls.html#log-archive-encryption-enabled)
@@ -21 +21 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED](https://docs.aws.amazon.com//controltower/latest/userguide/elective-controls.html#log-archive-access-enabled)
+  * [arn:aws:controltower:REGION::control/AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED](https://docs.aws.amazon.com/controltower/latest/userguide/elective-controls.html#log-archive-access-enabled)
@@ -23 +23 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED](https://docs.aws.amazon.com//controltower/latest/userguide/elective-controls.html#log-archive-policy-changes)
+  * [arn:aws:controltower:REGION::control/AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED](https://docs.aws.amazon.com/controltower/latest/userguide/elective-controls.html#log-archive-policy-changes)
@@ -25 +25 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY](https://docs.aws.amazon.com//controltower/latest/userguide/elective-controls.html#log-archive-retention-policy)
+  * [arn:aws:controltower:REGION::control/AWS-GR_AUDIT_BUCKET_RETENTION_POLICY](https://docs.aws.amazon.com/controltower/latest/userguide/elective-controls.html#log-archive-retention-policy)
@@ -27 +27 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_IAM_USER_MFA_ENABLED](https://docs.aws.amazon.com//controltower/latest/userguide/elective-controls.html#disallow-access-mfa)
+  * [arn:aws:controltower:REGION::control/AWS-GR_IAM_USER_MFA_ENABLED](https://docs.aws.amazon.com/controltower/latest/userguide/elective-controls.html#disallow-access-mfa)
@@ -29 +29 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS](https://docs.aws.amazon.com//controltower/latest/userguide/elective-controls.html#disallow-console-access-mfa)
+  * [arn:aws:controltower:REGION::control/AWS-GR_MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS](https://docs.aws.amazon.com/controltower/latest/userguide/elective-controls.html#disallow-console-access-mfa)
@@ -31 +31 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION](https://docs.aws.amazon.com//controltower/latest/userguide/elective-controls.html#disallow-s3-ccr)
+  * [arn:aws:controltower:REGION::control/AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION](https://docs.aws.amazon.com/controltower/latest/userguide/elective-controls.html#disallow-s3-ccr)
@@ -33 +33 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA](https://docs.aws.amazon.com//controltower/latest/userguide/elective-controls.html#disallow-s3-delete-mfa)
+  * [arn:aws:controltower:REGION::control/AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA](https://docs.aws.amazon.com/controltower/latest/userguide/elective-controls.html#disallow-s3-delete-mfa)
@@ -35 +35 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_S3_VERSIONING_ENABLED](https://docs.aws.amazon.com//controltower/latest/userguide/elective-controls.html#disallow-s3-no-versioning)
+  * [arn:aws:controltower:REGION::control/AWS-GR_S3_VERSIONING_ENABLED](https://docs.aws.amazon.com/controltower/latest/userguide/elective-controls.html#disallow-s3-no-versioning)
@@ -42 +42 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED](https://docs.aws.amazon.com//controltower/latest/userguide/data-residency-controls.html#subnet-auto-assign-public-ip-disabled)
+  * [arn:aws:controltower:REGION::control/AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED](https://docs.aws.amazon.com/controltower/latest/userguide/data-residency-controls.html#subnet-auto-assign-public-ip-disabled)
@@ -44 +44 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED](https://docs.aws.amazon.com//controltower/latest/userguide/data-residency-controls.html#autoscaling-launch-config-public-ip-disabled)
+  * [arn:aws:controltower:REGION::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED](https://docs.aws.amazon.com/controltower/latest/userguide/data-residency-controls.html#autoscaling-launch-config-public-ip-disabled)
@@ -46 +46 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING](https://docs.aws.amazon.com//controltower/latest/userguide/data-residency-controls.html#prevent-cross-region-networking)
+  * [arn:aws:controltower:REGION::control/AWS-GR_DISALLOW_CROSS_REGION_NETWORKING](https://docs.aws.amazon.com/controltower/latest/userguide/data-residency-controls.html#prevent-cross-region-networking)
@@ -48 +48 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS](https://docs.aws.amazon.com//controltower/latest/userguide/data-residency-controls.html#disallow-vpc-internet-access)
+  * [arn:aws:controltower:REGION::control/AWS-GR_DISALLOW_VPC_INTERNET_ACCESS](https://docs.aws.amazon.com/controltower/latest/userguide/data-residency-controls.html#disallow-vpc-internet-access)
@@ -50 +50 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_DISALLOW_VPN_CONNECTIONS](https://docs.aws.amazon.com//controltower/latest/userguide/data-residency-controls.html#prevent-vpn-connection)
+  * [arn:aws:controltower:REGION::control/AWS-GR_DISALLOW_VPN_CONNECTIONS](https://docs.aws.amazon.com/controltower/latest/userguide/data-residency-controls.html#prevent-vpn-connection)
@@ -52 +52 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC](https://docs.aws.amazon.com//controltower/latest/userguide/data-residency-controls.html#dms-replication-not-public)
+  * [arn:aws:controltower:REGION::control/AWS-GR_DMS_REPLICATION_NOT_PUBLIC](https://docs.aws.amazon.com/controltower/latest/userguide/data-residency-controls.html#dms-replication-not-public)
@@ -54 +54 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK](https://docs.aws.amazon.com//controltower/latest/userguide/data-residency-controls.html#ebs-snapshot-public-restorable-check)
+  * [arn:aws:controltower:REGION::control/AWS-GR_EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK](https://docs.aws.amazon.com/controltower/latest/userguide/data-residency-controls.html#ebs-snapshot-public-restorable-check)
@@ -56 +56 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP](https://docs.aws.amazon.com//controltower/latest/userguide/data-residency-controls.html#ec2-instance-no-public-ip)
+  * [arn:aws:controltower:REGION::control/AWS-GR_EC2_INSTANCE_NO_PUBLIC_IP](https://docs.aws.amazon.com/controltower/latest/userguide/data-residency-controls.html#ec2-instance-no-public-ip)
@@ -58 +58 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS](https://docs.aws.amazon.com//controltower/latest/userguide/data-residency-controls.html#eks-endpoint-no-public-access)
+  * [arn:aws:controltower:REGION::control/AWS-GR_EKS_ENDPOINT_NO_PUBLIC_ACCESS](https://docs.aws.amazon.com/controltower/latest/userguide/data-residency-controls.html#eks-endpoint-no-public-access)
@@ -60 +60 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY](https://docs.aws.amazon.com//controltower/latest/userguide/data-residency-controls.html#elasticsearch-in-vpc-only)
+  * [arn:aws:controltower:REGION::control/AWS-GR_ELASTICSEARCH_IN_VPC_ONLY](https://docs.aws.amazon.com/controltower/latest/userguide/data-residency-controls.html#elasticsearch-in-vpc-only)
@@ -62 +62 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP](https://docs.aws.amazon.com//controltower/latest/userguide/data-residency-controls.html#emr-master-no-public-ip)
+  * [arn:aws:controltower:REGION::control/AWS-GR_EMR_MASTER_NO_PUBLIC_IP](https://docs.aws.amazon.com/controltower/latest/userguide/data-residency-controls.html#emr-master-no-public-ip)
@@ -64 +64 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED](https://docs.aws.amazon.com//controltower/latest/userguide/data-residency-controls.html#lambda-function-public-access-prohibited)
+  * [arn:aws:controltower:REGION::control/AWS-GR_LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED](https://docs.aws.amazon.com/controltower/latest/userguide/data-residency-controls.html#lambda-function-public-access-prohibited)
@@ -66 +66 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW](https://docs.aws.amazon.com//controltower/latest/userguide/data-residency-controls.html#no-unrestricted-route-to-igw)
+  * [arn:aws:controltower:REGION::control/AWS-GR_NO_UNRESTRICTED_ROUTE_TO_IGW](https://docs.aws.amazon.com/controltower/latest/userguide/data-residency-controls.html#no-unrestricted-route-to-igw)
@@ -68 +68 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK](https://docs.aws.amazon.com//controltower/latest/userguide/data-residency-controls.html#redshift-cluster-public-access-check)
+  * [arn:aws:controltower:REGION::control/AWS-GR_REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK](https://docs.aws.amazon.com/controltower/latest/userguide/data-residency-controls.html#redshift-cluster-public-access-check)
@@ -70 +70 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC](https://docs.aws.amazon.com//controltower/latest/userguide/data-residency-controls.html#s3-account-level-public-access-blocks-periodic)
+  * [arn:aws:controltower:REGION::control/AWS-GR_S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC](https://docs.aws.amazon.com/controltower/latest/userguide/data-residency-controls.html#s3-account-level-public-access-blocks-periodic)
@@ -72 +72 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS](https://docs.aws.amazon.com//controltower/latest/userguide/data-residency-controls.html#sagemaker-notebook-no-direct-internet-access)
+  * [arn:aws:controltower:REGION::control/AWS-GR_SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS](https://docs.aws.amazon.com/controltower/latest/userguide/data-residency-controls.html#sagemaker-notebook-no-direct-internet-access)
@@ -74 +74 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC](https://docs.aws.amazon.com//controltower/latest/userguide/data-residency-controls.html#ssm-document-not-public)
+  * [arn:aws:controltower:REGION::control/AWS-GR_SSM_DOCUMENT_NOT_PUBLIC](https://docs.aws.amazon.com/controltower/latest/userguide/data-residency-controls.html#ssm-document-not-public)
@@ -81 +81 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_ENCRYPTED_VOLUMES](https://docs.aws.amazon.com//controltower/latest/userguide/strongly-recommended-controls.html#ebs-enable-encryption)
+  * [arn:aws:controltower:REGION::control/AWS-GR_ENCRYPTED_VOLUMES](https://docs.aws.amazon.com/controltower/latest/userguide/strongly-recommended-controls.html#ebs-enable-encryption)
@@ -83 +83 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_EBS_OPTIMIZED_INSTANCE](https://docs.aws.amazon.com//controltower/latest/userguide/strongly-recommended-controls.html#disallow-not-ebs-optimized)
+  * [arn:aws:controltower:REGION::control/AWS-GR_EBS_OPTIMIZED_INSTANCE](https://docs.aws.amazon.com/controltower/latest/userguide/strongly-recommended-controls.html#disallow-not-ebs-optimized)
@@ -85 +85 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_EC2_VOLUME_INUSE_CHECK](https://docs.aws.amazon.com//controltower/latest/userguide/strongly-recommended-controls.html#disallow-unattached-ebs)
+  * [arn:aws:controltower:REGION::control/AWS-GR_EC2_VOLUME_INUSE_CHECK](https://docs.aws.amazon.com/controltower/latest/userguide/strongly-recommended-controls.html#disallow-unattached-ebs)
@@ -87 +87 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK](https://docs.aws.amazon.com//controltower/latest/userguide/strongly-recommended-controls.html#disallow-rds-public-access)
+  * [arn:aws:controltower:REGION::control/AWS-GR_RDS_INSTANCE_PUBLIC_ACCESS_CHECK](https://docs.aws.amazon.com/controltower/latest/userguide/strongly-recommended-controls.html#disallow-rds-public-access)
@@ -89 +89 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED](https://docs.aws.amazon.com//controltower/latest/userguide/strongly-recommended-controls.html#disallow-rds-snapshot-public-access)
+  * [arn:aws:controltower:REGION::control/AWS-GR_RDS_SNAPSHOTS_PUBLIC_PROHIBITED](https://docs.aws.amazon.com/controltower/latest/userguide/strongly-recommended-controls.html#disallow-rds-snapshot-public-access)
@@ -91 +91 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_RDS_STORAGE_ENCRYPTED](https://docs.aws.amazon.com//controltower/latest/userguide/strongly-recommended-controls.html#disallow-rds-storage-unencrypted)
+  * [arn:aws:controltower:REGION::control/AWS-GR_RDS_STORAGE_ENCRYPTED](https://docs.aws.amazon.com/controltower/latest/userguide/strongly-recommended-controls.html#disallow-rds-storage-unencrypted)
@@ -93 +93 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_RESTRICTED_COMMON_PORTS](https://docs.aws.amazon.com//controltower/latest/userguide/strongly-recommended-controls.html#rdp-disallow-internet )
+  * [arn:aws:controltower:REGION::control/AWS-GR_RESTRICTED_COMMON_PORTS](https://docs.aws.amazon.com/controltower/latest/userguide/strongly-recommended-controls.html#rdp-disallow-internet )
@@ -95 +95 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_RESTRICTED_SSH](https://docs.aws.amazon.com//controltower/latest/userguide/strongly-recommended-controls.html#ssh-disallow-internet)
+  * [arn:aws:controltower:REGION::control/AWS-GR_RESTRICTED_SSH](https://docs.aws.amazon.com/controltower/latest/userguide/strongly-recommended-controls.html#ssh-disallow-internet)
@@ -97 +97 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_RESTRICT_ROOT_USER](https://docs.aws.amazon.com//controltower/latest/userguide/strongly-recommended-controls.html#disallow-root-auser-actions)
+  * [arn:aws:controltower:REGION::control/AWS-GR_RESTRICT_ROOT_USER](https://docs.aws.amazon.com/controltower/latest/userguide/strongly-recommended-controls.html#disallow-root-auser-actions)
@@ -99 +99 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS](https://docs.aws.amazon.com//controltower/latest/userguide/strongly-recommended-controls.html#disallow-root-access-keys)
+  * [arn:aws:controltower:REGION::control/AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS](https://docs.aws.amazon.com/controltower/latest/userguide/strongly-recommended-controls.html#disallow-root-access-keys)
@@ -101 +101 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED](https://docs.aws.amazon.com//controltower/latest/userguide/strongly-recommended-controls.html#enable-root-mfa)
+  * [arn:aws:controltower:REGION::control/AWS-GR_ROOT_ACCOUNT_MFA_ENABLED](https://docs.aws.amazon.com/controltower/latest/userguide/strongly-recommended-controls.html#enable-root-mfa)
@@ -103 +103 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED](https://docs.aws.amazon.com//controltower/latest/userguide/strongly-recommended-controls.html#s3-disallow-public-read)
+  * [arn:aws:controltower:REGION::control/AWS-GR_S3_BUCKET_PUBLIC_READ_PROHIBITED](https://docs.aws.amazon.com/controltower/latest/userguide/strongly-recommended-controls.html#s3-disallow-public-read)
@@ -105 +105 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED](https://docs.aws.amazon.com//controltower/latest/userguide/strongly-recommended-controls.html#s3-disallow-public-write)
+  * [arn:aws:controltower:REGION::control/AWS-GR_S3_BUCKET_PUBLIC_WRITE_PROHIBITED](https://docs.aws.amazon.com/controltower/latest/userguide/strongly-recommended-controls.html#s3-disallow-public-write)
@@ -107 +107 @@ Each item in the list that follows serves as a link, which provides more informa
-  * [arn:aws:controltower:REGION::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS](https://docs.aws.amazon.com//controltower/latest/userguide/strongly-recommended-controls.html#ensure-cloudtrail-enabled-recommended)
+  * [arn:aws:controltower:REGION::control/AWS-GR_DETECT_CLOUDTRAIL_ENABLED_ON_MEMBER_ACCOUNTS](https://docs.aws.amazon.com/controltower/latest/userguide/strongly-recommended-controls.html#ensure-cloudtrail-enabled-recommended)