AWS controltower: Document disabling AWS Backup baseline for nested OUs via API/console

Service: controltower · 2026-09-27 · Documentation medium

File: controltower/latest/userguide/stop-backups.md

Summary

Expanded instructions for disabling the AWS Backup baseline, adding the requirement to disable child OUs before parent OUs and step-by-step API (ListBaselines, ListEnabledBaselines, DisableBaseline) and console procedures.

Security assessment

The change documents operational procedures for managing the AWS Backup baseline (a data-protection control) across nested OUs, including correct ordering and API/console steps. It is security-adjacent hardening/backup guidance but does not address a specific vulnerability or incident.

Evidence

+If you have nested OUs, disable the AWS Backup baseline on the child OUs before the parent OU. While the AWS Backup baseline is still enabled on a child OU, AWS Control Tower cannot disable it on the parent OU.

Diff

diff --git a/controltower/latest/userguide/stop-backups.md b/controltower/latest/userguide/stop-backups.md
index 11ab8240a..bdc2f046e 100644
--- a//controltower/latest/userguide/stop-backups.md
+++ b//controltower/latest/userguide/stop-backups.md
@@ -19 +19,17 @@ If AWS Backup is enabled, you must disable the AWS Backup baseline from all OUs
-To disable the AWS Backup baseline on an OU, you can call the `DisableBaseline` API. The nested OUs inherit this status, so that the AWS Backup baseline baseline is disabled for them also.
+If you have nested OUs, disable the AWS Backup baseline on the child OUs before the parent OU. While the AWS Backup baseline is still enabled on a child OU, AWS Control Tower cannot disable it on the parent OU.
+
+You can disable the AWS Backup baseline on an OU by using the AWS Control Tower APIs or the AWS Control Tower console.
+
+**To disable the AWS Backup baseline (API)**
+
+First, find the ARN of the AWS Backup baseline. Call the `ListBaselines` API and query for the baseline whose `name` is `BackupBaseline` to get its ARN.
+    
+    
+    aws controltower list-baselines --query 'baselines[?name==`BackupBaseline`]'
+
+Then, using that ARN, identify which OUs have the AWS Backup baseline enabled. Call the `ListEnabledBaselines` API, filtering on the `BackupBaseline` baseline identifier, to find each enabled baseline and its `enabledBaselineIdentifier` ARN to disable.
+    
+    
+    aws controltower list-enabled-baselines --filter baselineIdentifiers=BackupBaseline-ARN
+
+To disable the AWS Backup baseline on an OU, you can call the `DisableBaseline` API.
@@ -25,0 +42,13 @@ _Example command:_
+**To disable the AWS Backup baseline (console)**
+
+  1. Sign in to the AWS Control Tower console and navigate to the **Organization** page.
+
+  2. Choose the OU whose **AWS Backup baseline status** is **Enabled** to open the OU detail page.
+
+  3. In the **Integrations on this OU - optional** section, under **AWS Backup** , choose **Edit**.
+
+  4. In the dialog that appears, select **Disable** , and then choose **Confirm**.
+
+
+
+