65 actions in the controltower service. Select an action to see its access level, resource ARNs, condition keys, and a copy-paste IAM policy.
Grants permission to create a landing zone
Grants permission to create an account managed by AWS Control Tower
Grants permission to delete AWS Control Tower landing zone
Grants permission to deregister an account created through the account factory from AWS Control Tower
Grants permission to deregister an organizational unit from AWS Control Tower management
Grants permission to describe the current account factory configuration
Grants permission to describe resources managed by core accounts in AWS Control Tower
Grants permission to describe a guardrail
Grants permission to describe a guardrail for a organizational unit
Grants permission to describe the current Landing Zone configuration
Grants permission to describe an account created through account factory
Grants permission to describe an AWS Organizations organizational unit managed by AWS Control Tower
Grants permission to describe a Register Organizational Unit Operation
Grants permission to describe the current AWS Control Tower IAM Identity Center configuration
Grants permission to disable a Baseline on a target
Grants permission to remove a control from an organizational unit
Grants permission to disable a guardrail from an organizational unit
Grants permission to enable a Baseline on a target
Grants permission to activate a control for an organizational unit
Grants permission to enable a guardrail to an organizational unit
Grants permission to describe an account email and validate that it exists
Grants permission to list available updates for the current AWS Control Tower deployment
Grants permission to get Baseline details
Grants permission to get the current status of a particular Baseline operation
Grants permission to get the current status of a particular EnabledControl or DisableControl operation
Grants permission to get an enabled Baseline
Grants permission to get an enabled control from an organizational unit
Grants permission to get the current compliance status of a guardrail
Grants permission to get the home region of the AWS Control Tower setup
Grants permission to get the current status of the landing zone setup
Grants permission to get the current landing zone drift status
Grants permission to get the current status of a particular landing zone operation
Grants permission to get the current status of the landing zone setup
Grants permission to list Baselines
Grants permission to list all control operations
Grants permission to list the current directory groups available through IAM Identity Center
Grants permission to list occurrences of drift in AWS Control Tower
Grants permission to list enabled Baselines
Grants permission to list all enabled controls in a specified organizational unit
Grants permission to list currently enabled guardrails
Grants permission to list Precheck details for an Organizational Unit
Grants permission to list the compliance of external AWS Config rules
Grants permission to list all available guardrails
Grants permission to list guardrails and their current state for a organizational unit
Grants permission to list existing guardrail violations
Grants permission to list all landing zone operations
Grants permission to list all landing zones
Grants permission to list accounts managed through AWS Control Tower
Grants permission to list managed accounts with a specified guardrail applied
Grants permission to list managed accounts under an organizational unit
Grants permission to list organizational units managed by AWS Control Tower
Grants permission to list managed organizational units that have a specified guardrail applied
Grants permission to list the tags for a resource
Grants permission to set up an organizational unit to be managed by AWS Control Tower
Grants permission to perform validations in an account
Grants permission to reset an enabled Baseline
Grants permission to reset an enabled control for an organizational unit
Grants permission to reset a landing zone
Grants permission to set up or update AWS Control Tower landing zone
Grants permission to add tags to a resource
Grants permission to remove tags from a resource
Grants permission to update the account factory configuration
Grants permission to update an enabled Baseline
Grants permission to update an enabled control for an organizational unit
Grants permission to update a landing zone