Control Tower

3 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

CTEnabledControl # GA

CTEnabledControl is the Schema for managing AWS Control Tower enabled controls.

kubectl get ctenabledcontrols · example on GitHub

Example

# CTEnabledControl — Control Tower
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/controltower.html#ctenabledcontrol
apiVersion: aws.konfig.io/v1alpha1
kind: CTEnabledControl
metadata:
  name: example-ctenabledcontrol
  namespace: default
spec:
  controlIdentifier: example-xx
  providerRef:
    name: example-ctenabledcontrol
    region: us-east-1
  tags:
    environment: dev
    team: platform
  targetIdentifier: example-xx

Spec

Field	Type	Required	Description
`controlIdentifier`	string	yes	ControlIdentifier is the ARN of the control to enable.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply to the EnabledControl resource.
`targetIdentifier`	string	yes	TargetIdentifier is the ARN of the organizational unit the control is enabled on.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the Amazon Resource Name of the EnabledControl resource.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`operationIdentifier`	string	—	OperationIdentifier tracks the in-flight asynchronous enable operation.
`state`	string	—	State is the last observed control operation status (IN_PROGRESS, SUCCEEDED, or FAILED).

ControlTowerEnabledBaseline # CLOUD CONTROL · AWS::ControlTower::EnabledBaseline ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: organization-wide baseline applied to enrolled OUs. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. ControlTowerEnabledBaseline manages AWS::ControlTower::EnabledBaseline through the AWS Cloud Control API.

kubectl get controltowerenabledbaselines · example on GitHub

Example

# ControlTowerEnabledBaseline — Control Tower
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/controltower.html#controltowerenabledbaseline
apiVersion: aws.konfig.io/v1alpha1
kind: ControlTowerEnabledBaseline
metadata:
  name: example-controltowerenabledbaseline
  namespace: default
spec:
  baselineIdentifier: example-xxxxxxxxxxxx
  baselineVersion: '1.0'
  parameters:
  - key: example
  providerRef:
    name: example-controltowerenabledbaseline
    region: us-east-1
  tags:
  - key: example
    value: example
  targetIdentifier: example-xxxxxxxxxxxx

Spec

Field	Type	Required	Description
`baselineIdentifier`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`baselineVersion`	string	yes
`parameters`	array<object>	—
`parameters[].key`	string	—
`parameters[].value`	object	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes
`targetIdentifier`	string	yes	Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`enabledBaselineIdentifier`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

ControlTowerLandingZone # CLOUD CONTROL · AWS::ControlTower::LandingZone ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: organization-wide landing zone; changes cascade to all enrolled accounts. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. ControlTowerLandingZone manages AWS::ControlTower::LandingZone through the AWS Cloud Control API.

kubectl get controltowerlandingzones · example on GitHub

Example

# ControlTowerLandingZone — Control Tower
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/controltower.html#controltowerlandingzone
apiVersion: aws.konfig.io/v1alpha1
kind: ControlTowerLandingZone
metadata:
  name: example-controltowerlandingzone
  namespace: default
spec:
  providerRef:
    name: example-controltowerlandingzone
    region: us-east-1
  remediationTypes:
  - example
  tags:
  - key: example
    value: example
  version: '1.0'

Spec

Field	Type	Required	Description
`manifest`	object	yes
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`remediationTypes`	array<string>	—
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes
`version`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`driftStatus`	enum	—	Read-only: reported by AWS after creation. Allowed: `DRIFTED, IN_SYNC`
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`landingZoneIdentifier`	string	—	Read-only: reported by AWS after creation.
`lastSyncTime`	string	—
`latestAvailableVersion`	string	—	Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	Read-only: reported by AWS after creation. Allowed: `ACTIVE, PROCESSING, FAILED`