IAM / management / controltower

AWS Control Tower (IAM)

JSON →
AWScontroltowermanagement

AWS Control Tower provides a pre-configured, secure, multi-account AWS environment based on best practices and governance rules.

iamaws
docs ↗
Permissions
Actions in this service
controltower:GetLandingZone
controltower:ListLandingZones
controltower:GetEnabledControl
controltower:ListEnabledControls
controltower:GetBaseline
controltower:ListBaselines
controltower:GetHomeRegion
controltower:ListGuardrails
Policy
Minimal privilege example

Copy-paste least-privilege policy statement — not yet harness-verified.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "controltower:GetLandingZone", "controltower:ListLandingZones", "controltower:GetEnabledControl", "controltower:ListEnabledControls", "controltower:GetBaseline", "controltower:ListBaselines", "controltower:GetHomeRegion", "controltower:ListGuardrails" ], "Resource": "*" } ] }
SDK mapping
Method → permission

SDK method mapping (e.g. boto3.get_object() → s3:GetObject) is not yet collected.

Footguns
Known gotchas
Avoid controltower:* — grants full control including creating, updating, and deleting landing zones and baselines
Avoid controltower:CreateLandingZone and controltower:DeleteLandingZone — can disrupt the entire multi-account governance structure
Resources
docshttps://servicereference.us-east-1.amazonaws.com/v1/controltower/controltower.json ↗