本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。
# AWS Control Tower 使用 的範例 AWS CLI
下列程式碼範例示範如何使用 AWS Command Line Interface 搭配 來執行動作和實作常見案例 AWS Control Tower。
*Actions* 是大型程式的程式碼摘錄，必須在內容中執行。雖然動作會告訴您如何呼叫個別服務函數，但您可以在其相關情境中查看內容中的動作。
每個範例均包含完整原始碼的連結，您可在連結中找到如何設定和執行內容中程式碼的相關指示。
**Topics**
+ [動作](#actions)
## 動作
### `create-landing-zone`
以下程式碼範例顯示如何使用 `create-landing-zone`。
**AWS CLI**
**建立 Control Tower 登陸區域**
下列`create-landing-zone`範例會建立 AWS Control Tower 登陸區域。
```
aws controltower create-landing-zone \
--landing-zone-version {{3.3}} \
--manifest {{"file://LandingZoneManifest.json"}}
```
輸出：
```
{
"arn": "arn:aws:controltower:us-east-1:123456789012:landingzone/13CJG46WZKXXX4X5",
"operationIdentifier": "55XXXXXX-e2XX-41XX-a7XX-446XXXXXXXXX"
}
```
如需詳細資訊，請參閱 [AWS Control Tower 使用者指南中的 Control Tower 入門](https://docs.aws.amazon.com/controltower/latest/userguide/getting-started-with-control-tower.html)。 *AWS *
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [CreateLandingZone](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/create-landing-zone.html)。
### `delete-landing-zone`
以下程式碼範例顯示如何使用 `delete-landing-zone`。
**AWS CLI**
**解除委任登陸區域**
下列`delete-landing-zone`範例會停用 AWS Control Tower 登陸區域。
```
aws controltower delete-landing-zone \
--landing-zone-identifier {{arn:aws:controltower:us-east-1:123456789012:landingzone/13CJG46WZKXXX4X5}}
```
輸出：
```
{
"operationIdentifier": "47XXXXXX-a6XX-82XX-c9XX-432XXXXXXXXX"
}
```
如需詳細資訊，請參閱《[AWS Control Tower 使用者指南》中的停用 Control Tower 登陸區域](https://docs.aws.amazon.com/controltower/latest/userguide/decommission-landing-zone.html)。 *AWS *
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [DeleteLandingZone](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/delete-landing-zone.html)。
### `disable-baseline`
以下程式碼範例顯示如何使用 `disable-baseline`。
**AWS CLI**
**停用 Control Tower 基準**
下列`disable-baseline`範例會停用 AWS Control Tower 基準。
```
aws controltower disable-baseline \
--enabled-baseline-identifier {{arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XOM12BEL4YD578CQ2}}
```
輸出：
```
{
"operationIdentifier": "b33486d7-5396-4ad0-9eae-3a57969fe8cd"
}
```
如需詳細資訊，請參閱 *AWS Control Tower 使用者指南*中的[基準類型](https://docs.aws.amazon.com/controltower/latest/userguide/types-of-baselines.html)。
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [DisableBaseline](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/disable-baseline.html)。
### `disable-control`
以下程式碼範例顯示如何使用 `disable-control`。
**AWS CLI**
**停用 Control Tower 控制項**
下列`disable-control`範例會停用已啟用 AWS Control Tower 的控制項。
```
aws controltower disable-control \
--control-identifier {{arn:aws:controlcatalog:::control/497wrm2xnk1wxlf4obrxxxxxx}} \
--target-identifier {{arn:aws:organizations::123456789012:ou/o-s64ryxxxxx/ou-oqxx-i5wnxxxx}}
```
輸出：
```
{
"operationIdentifier": "b8f0dxxx-08xx-43xx-a2xx-568e9922xxxx"
}
```
如需詳細資訊，請參閱《[AWS Control Tower 使用者指南》中的關於](https://docs.aws.amazon.com/controltower/latest/controlreference/controls.html) *AWS Control Tower 中的控制項*。
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [DisableControl](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/disable-control.html)。
### `enable-baseline`
以下程式碼範例顯示如何使用 `enable-baseline`。
**AWS CLI**
**範例 1：啟用已停用的 Control Tower 基準**
如果基準已停用，下列`enable-baseline`範例會啟用 AWS Control Tower `IdentityCenterBaseline` 基準。
```
aws controltower enable-baseline \
--baseline-identifier {{arn:aws:controltower:us-east-1::baseline/17BSJV3IGJ2QSGA2}} \
--baseline-version {{4.0}} \
--target-identifier {{arn:aws:organizations::123456789012:ou/o-s64ryixxxx/ou-oq9f-i5wnxxxx}}
```
輸出：
```
{
"arn": "arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XOM12BEL4YD578CQ2",
"operationIdentifier": "51e190ac-8a37-4f6d-b63c-fb5104b5db38"
}
```
如需詳細資訊，請參閱 *AWS Control Tower 使用者指南*中的[基準類型](https://docs.aws.amazon.com/controltower/latest/userguide/types-of-baselines.html)。
**範例 2：啟用已啟用的 Control Tower 基準**
下列`enable-baseline`範例會在啟用基準時啟用 AWS Control Tower `IdentityCenterBaseline` 基準。
```
aws controltower enable-baseline \
--baseline-identifier {{arn:aws:controltower:us-east-1::baseline/17BSJV3IGJ2QSGA2}} \
--baseline-version {{4.0}} \
--target-identifier {{arn:aws:organizations::123456789012:ou/o-s64ryixxxx/ou-oqxx-i5wnxxxx}} \
--parameters '{{[{"key":"IdentityCenterEnabledBaselineArn","value":"arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XAJNZNCBC1I386C7B"}]}}'
```
輸出：
```
{
"arn": "arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XOM12BEL4YD578CQ2",
"operationIdentifier": "51e190ac-8a37-4f6d-b63c-fb5104b5db38"
}
```
如需詳細資訊，請參閱 *AWS Control Tower 使用者指南*中的[基準類型](https://docs.aws.amazon.com/controltower/latest/userguide/types-of-baselines.html)。
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [EnableBaseline](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/enable-baseline.html)。
### `enable-control`
以下程式碼範例顯示如何使用 `enable-control`。
**AWS CLI**
**啟用 Control Tower 控制項**
下列`enable-control`範例會啟用 AWS Control Tower 控制項。
```
aws controltower enable-control \
--control-identifier {{arn:aws:controlcatalog:::control/497wrm2xnk1wxlf4obrxxxxxx}} \
--target-identifier {{arn:aws:organizations::123456789012:ou/o-s64ryxxxxx/ou-oqxx-i5wnxxxx}}
```
輸出：
```
{
"arn": "arn:aws:controltower:us-east-1:123456789012:enabledcontrol/18J5KBJ3W3VTIRLV",
"operationIdentifier": "7691fc5a-de87-4540-8c95-b0aabd56382c"
}
```
如需詳細資訊，請參閱 Control [Tower 使用者指南中的關於 AWS Control](https://docs.aws.amazon.com/controltower/latest/controlreference/controls.html) Tower 中的控制項。 *AWS *
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [EnableControl](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/enable-control.html)。
### `get-baseline-operation`
以下程式碼範例顯示如何使用 `get-baseline-operation`。
**AWS CLI**
**取得 Control Tower 基準操作**
下列`get-baseline-operation`範例會取得 AWS Control Tower 基準操作的詳細資訊。
```
aws controltower get-baseline-operation \
--operation-identifier {{"51e190ac-8a37-4f6d-b63c-fb5104b5db38"}}
```
輸出：
```
{
"baselineOperation": {
"endTime": "2025-04-17T23:48:46+00:00",
"operationIdentifier": "51e190ac-8a37-4f6d-b63c-fb5104b5db38",
"operationType": "ENABLE_BASELINE",
"startTime": "2025-04-17T23:46:37+00:00",
"status": "SUCCEEDED",
"statusMessage": "AWS Control Tower completed the baseline operation successfully."
}
}
```
如需詳細資訊，請參閱 *AWS Control Tower 使用者指南*中的[基準類型](https://docs.aws.amazon.com/controltower/latest/userguide/types-of-baselines.html)。
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [GetBaselineOperation](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/get-baseline-operation.html)。
### `get-baseline`
以下程式碼範例顯示如何使用 `get-baseline`。
**AWS CLI**
**取得 Control Tower 基準**
下列`get-baseline`範例會取得 AWS Control Tower 基準的詳細資訊。
```
aws controltower get-baseline \
--baseline-identifier {{arn:aws:controltower:us-east-1::baseline/LN25R72TTG6IGPTQ}}
```
輸出：
```
{
"arn": "arn:aws:controltower:us-east-1::baseline/LN25R72TTG6IGPTQ",
"description": "Sets up shared resources for AWS Identity Center, which prepares the AWSControlTowerBaseline to set up Identity Center access for accounts.",
"name": "IdentityCenterBaseline"
}
```
如需詳細資訊，請參閱 *AWS Control Tower 使用者指南*中的[基準類型](https://docs.aws.amazon.com/controltower/latest/userguide/types-of-baselines.html)。
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [GetBaseline](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/get-baseline.html)。
### `get-control-operation`
以下程式碼範例顯示如何使用 `get-control-operation`。
**AWS CLI**
**取得 Control Tower 控制操作**
下列`get-control-operation`範例會取得 AWS Control Tower 控制操作的詳細資訊。
```
aws controltower get-control-operation \
--operation-identifier {{"7691fc5a-de87-4540-8c95-b0aabd56382c"}}
```
輸出：
```
{
"controlOperation": {
"controlIdentifier": "arn:aws:controlcatalog:::control/497wrm2xnk1wxlf4obrdo7mej",
"enabledControlIdentifier": "arn:aws:controltower:us-east-1:123456789012:enabledcontrol/18J5KBJ3W3VTIRLV",
"endTime": "2025-04-17T03:08:55+00:00",
"operationIdentifier": "7691fc5a-de87-4540-8c95-b0aabd56382c",
"operationType": "ENABLE_CONTROL",
"startTime": "2025-04-17T03:07:52+00:00",
"status": "SUCCEEDED",
"statusMessage": "Operation was successful.",
"targetIdentifier": "arn:aws:organizations::123456789012:ou/o-s64ryixxxx/ou-oqxx-i5wnxxxx"
}
}
```
如需詳細資訊，請參閱《[AWS Control Tower 使用者指南》中的關於](https://docs.aws.amazon.com/controltower/latest/controlreference/controls.html) *AWS Control Tower 中的控制項*。
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [GetControlOperation](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/get-control-operation.html)。
### `get-enabled-baseline`
以下程式碼範例顯示如何使用 `get-enabled-baseline`。
**AWS CLI**
**取得已啟用 Control Tower 的基準**
下列`get-enabled-baseline`範例取得已啟用 AWS Control Tower 基準的詳細資訊。
```
aws controltower get-enabled-baseline \
--enabled-baseline-identifier {{arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XOM12BEL4YD578CQ2}}
```
輸出：
```
{
"enabledBaselineDetails": {
"arn": "arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XOM12BEL4YD578CQ2",
"baselineIdentifier": "arn:aws:controltower:us-east-1::baseline/17BSJV3IGJ2QSGA2",
"baselineVersion": "4.0",
"parameters": [
{
"key": "IdentityCenterEnabledBaselineArn",
"value": "arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XAJNZNCBC1I386C7B"
}
],
"statusSummary": {
"lastOperationIdentifier": "51e190ac-8a37-4f6d-b63c-fb5104b5db38",
"status": "SUCCEEDED"
},
"targetIdentifier": "arn:aws:organizations::123456789012:ou/o-3onqfufxxx/ou-g8xx-5kluxxxx"
}
}
```
如需詳細資訊，請參閱 *AWS Control Tower 使用者指南*中的[基準類型](https://docs.aws.amazon.com/controltower/latest/userguide/types-of-baselines.html)。
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [GetEnabledBaseline](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/get-enabled-baseline.html)。
### `get-enabled-control`
以下程式碼範例顯示如何使用 `get-enabled-control`。
**AWS CLI**
**取得已啟用 Control Tower 的控制項**
下列`get-enabled-control`範例會取得已啟用 AWS Control Tower 控制的詳細資訊。
```
aws controltower get-enabled-control \
--enabled-control-identifier {{arn:aws:controltower:us-east-1:123456789012:enabledcontrol/26RGJRSLXCP1KW8D}}
```
輸出：
```
{
"enabledControlDetails": {
"arn": "arn:aws:controltower:us-east-1:123456789012:enabledcontrol/26RGJRSLXCP1KW8D",
"controlIdentifier": "arn:aws:controltower:us-east-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED",
"driftStatusSummary": {
"driftStatus": "NOT_CHECKING"
},
"parameters": [],
"statusSummary": {
"status": "SUCCEEDED"
},
"targetIdentifier": "arn:aws:organizations::123456789012:ou/o-s64ryixxxx/ou-oqxx-i5wnxxxx",
"targetRegions": [
{
"name": "ap-south-2"
},
{
"name": "ap-south-1"
},
{
"name": "eu-south-1"
},
{
"name": "us-east-1"
}
]
}
}
```
如需詳細資訊，請參閱 Control [Tower 使用者指南中的關於 AWS Control](https://docs.aws.amazon.com/controltower/latest/controlreference/controls.html) Tower 中的控制項。 *AWS *
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [GetEnabledControl](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/get-enabled-control.html)。
### `get-landing-zone-operation`
以下程式碼範例顯示如何使用 `get-landing-zone-operation`。
**AWS CLI**
**取得 Control Tower 登陸區域操作**
下列`get-landing-zone-operation`範例會取得 AWS Control Tower 登陸區域操作的詳細資訊。
```
aws controltower get-landing-zone-operation \
--operation-identifier {{ee9d0d2d-6532-42d8-9b85-3fbb0700a606}}
```
輸出：
```
{
"operationDetails": {
"operationIdentifier": "ee9d0d2d-6532-42d8-9b85-3fbb0700xxxx",
"operationType": "RESET",
"startTime": "2025-04-17T03:19:33+00:00",
"status": "IN_PROGRESS"
}
}
```
如需詳細資訊，請參閱 [AWS Control Tower 使用者指南中的 Control Tower 入門](https://docs.aws.amazon.com/controltower/latest/userguide/getting-started-with-control-tower.html)。 *AWS *
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [GetLandingZoneOperation](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/get-landing-zone-operation.html)。
### `get-landing-zone`
以下程式碼範例顯示如何使用 `get-landing-zone`。
**AWS CLI**
**描述 Control Tower 登陸區域**
下列`get-landing-zone`範例會取得 AWS Control Tower 登陸區域的詳細資訊。
```
aws controltower get-landing-zone \
--landing-zone-identifier {{arn:aws:controltower:us-east-1:123456789012:landingzone/13CJG46WZKXXX4X5}}
```
輸出：
```
{
"landingZone": {
"arn": "arn:aws:controltower:us-east-1:123456789012:landingzone/13CJG46WZKXXX4X5",
"driftStatus": {
"status": "IN_SYNC"
},
"latestAvailableVersion": "3.3",
"manifest": {
"accessManagement": {
"enabled": true
},
"securityRoles": {
"accountId": "098765432101"
},
"governedRegions": [
"us-east-1",
"us-west-2"
],
"organizationStructure": {
"security": {
"name": "Security"
}
},
"centralizedLogging": {
"accountId": "111122223333",
"configurations": {
"loggingBucket": {
"retentionDays": 365
},
"kmsKeyArn": "arn:aws:kms:us-east-1:123456789012:key/example-key-id",
"accessLoggingBucket": {
"retentionDays": 3650
}
},
"enabled": true
}
},
"status": "ACTIVE",
"version": "3.3"
}
}
```
如需詳細資訊，請參閱 [AWS Control Tower 使用者指南中的 Control Tower 入門](https://docs.aws.amazon.com/controltower/latest/userguide/getting-started-with-control-tower.html)。 *AWS *
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [GetLandingZone](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/get-landing-zone.html)。
### `list-baselines`
以下程式碼範例顯示如何使用 `list-baselines`。
**AWS CLI**
**列出 Control Tower 基準**
下列`list-baselines`範例列出所有可用的 AWS Control Tower 基準。
```
aws controltower list-baselines
```
輸出：
```
{
"baselines": [
{
"arn": "arn:aws:controltower:us-east-1::baseline/4T4HA1KMO10S6311",
"description": "Sets up resources to monitor security and compliance of accounts in your organization.",
"name": "AuditBaseline"
},
{
"arn": "arn:aws:controltower:us-east-1::baseline/J8HX46AHS5MIKQPD",
"description": "Sets up a central repository for logs of API activities and resource configurations from accounts in your organization.",
"name": "LogArchiveBaseline"
},
{
"arn": "arn:aws:controltower:us-east-1::baseline/LN25R72TTG6IGPTQ",
"description": "Sets up shared resources for AWS Identity Center, which prepares the AWSControlTowerBaseline to set up Identity Center access for accounts.",
"name": "IdentityCenterBaseline"
},
{
"arn": "arn:aws:controltower:us-east-1::baseline/17BSJV3IGJ2QSGA2",
"description": "Sets up resources and mandatory controls for member accounts within the target OU, required for AWS Control Tower governance.",
"name": "AWSControlTowerBaseline"
},
{
"arn": "arn:aws:controltower:us-east-1::baseline/3WPD0NA6TJ9AOMU2",
"description": "Sets up a central AWS Backup vault in your organization.",
"name": "BackupCentralVaultBaseline"
},
{
"arn": "arn:aws:controltower:us-east-1::baseline/H6C5JFCJJ3CPU3J5",
"description": "Sets up AWS Backup Audit Manager.",
"name": "BackupAdminBaseline"
},
{
"arn": "arn:aws:controltower:us-east-1::baseline/APO9ATVPBKFRRGLK",
"description": "Sets up a local AWS Backup vault and attaches multiple AWS Backup plans.",
"name": "BackupBaseline"
}
]
}
```
如需詳細資訊，請參閱 *AWS Control Tower 使用者指南*中的[基準類型](https://docs.aws.amazon.com/controltower/latest/userguide/types-of-baselines.html)。
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [ListBaselines](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/list-baselines.html)。
### `list-control-operations`
以下程式碼範例顯示如何使用 `list-control-operations`。
**AWS CLI**
**列出 Control Tower 控制操作**
下列`list-control-operations`範例列出進行中或已排入佇列的 AWS Control Tower 控制項詳細資訊。
```
aws controltower list-control-operations
```
輸出：
```
{
"controlOperations": [
{
"startTime": "2024-02-19T19:22:08+00:00",
"operationType": "ENABLE_CONTROL",
"status": "IN_PROGRESS",
"statusMessage": "Operation is in progress.",
"operationIdentifier": "f9f43b45-db27-44df-89d8-f9129e3632XX",
"controlIdentifier": "arn:aws:controltower:us-east-1::control/SKIBWKYUQAAC",
"targetIdentifier": "arn:aws:organizations::123456789012:ou/o-yy67i3pfv2/ou-slt4-8abknXXX",
"enabledControlIdentifier": "arn:aws:controltower:us-east-1:123456789012:enabledcontrol/RWZFSHV2BBRU6JSE"
},
{
"startTime": "2024-02-19T19:21:09+00:00",
"operationType": "ENABLE_CONTROL",
"status": "IN_PROGRESS",
"statusMessage": "Operation is in progress",
"operationIdentifier": "171ee0b1-e926-486e-9775-005bd244ccXX",
"controlIdentifier": "arn:aws:controltower:us-east-1::control/PDKYAANJEWJE",
"targetIdentifier": "arn:aws:organizations::123456789012:ou/o-yy67i3pfv2/ou-slt4-fl6miXXX",
"enabledControlIdentifier": "arn:aws:controltower:us-east-2:123456789012:enabledcontrol/XCNJARWZFSHV6JSE"
}
]
}
```
如需詳細資訊，請參閱《[AWS Control Tower 使用者指南》中的關於](https://docs.aws.amazon.com/controltower/latest/controlreference/controls.html) *AWS Control Tower 中的控制項*。
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [ListControlOperations](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/list-control-operations.html)。
### `list-enabled-baselines`
以下程式碼範例顯示如何使用 `list-enabled-baselines`。
**AWS CLI**
**列出已啟用 Control Tower 的基準**
下列`list-enabled-baselines`範例列出所有已啟用的 AWS Control Tower 基準。
```
aws controltower list-enabled-baselines
```
輸出：
```
{
"enabledBaselines": [
{
"arn": "arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XAJNZNCBC1I386C7B",
"baselineIdentifier": "arn:aws:controltower:us-east-1::baseline/LN25R72TTG6IGPTQ",
"statusSummary": {
"status": "SUCCEEDED"
},
"targetIdentifier": "arn:aws:organizations::123456789012:account/o-3onqfuxxxx/123456789012"
},
{
"arn": "arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XAH3ZJL9DWA386CA5",
"baselineIdentifier": "arn:aws:controltower:us-east-1::baseline/4T4HA1KMO10S6311",
"statusSummary": {
"status": "SUCCEEDED"
},
"targetIdentifier": "arn:aws:organizations::123456789012:account/o-3onqfuxxxx/012345098765"
},
{
"arn": "arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XALFJ9548TL386CBT",
"baselineIdentifier": "arn:aws:controltower:us-east-1::baseline/J8HX46AHS5MIKQPD",
"statusSummary": {
"status": "SUCCEEDED"
},
"targetIdentifier": "arn:aws:organizations::123456789012:account/o-3onqfuxxxx/098765432109"
}
]
}
```
如需詳細資訊，請參閱 *AWS Control Tower 使用者指南*中的[基準類型](https://docs.aws.amazon.com/controltower/latest/userguide/types-of-baselines.html)。
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [ListEnabledBaselines](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/list-enabled-baselines.html)。
### `list-enabled-controls`
以下程式碼範例顯示如何使用 `list-enabled-controls`。
**AWS CLI**
**列出已啟用 Control Tower 的控制項**
下列`list-enabled-controls`範例會取得已啟用 AWS Control Tower 控制項的詳細資訊。
```
aws controltower list-enabled-controls \
--target-identifier {{arn:aws:organizations::123456789012:ou/o-s64ryxxxxx/ou-oqxx-i5wnxxxx}}
```
輸出：
```
{
"enabledControls": [
{
"arn": "arn:aws:controltower:us-east-1:123456789012:enabledcontrol/26RGJRSLXCP1KW8D",
"controlIdentifier": "arn:aws:controltower:us-east-1::control/AWS-GR_CLOUDTRAIL_CHANGE_PROHIBITED",
"driftStatusSummary": {
"driftStatus": "NOT_CHECKING"
},
"statusSummary": {
"status": "SUCCEEDED"
},
"targetIdentifier": "arn:aws:organizations::123456789012:ou/o-s64ryxxxxx/ou-oqxx-i5wnxxxx"
},
{
"arn": "arn:aws:controltower:us-east-1:123456789012:enabledcontrol/18AY24CWKM6IVSLU",
"controlIdentifier": "arn:aws:controltower:us-east-1::control/AWS-GR_CLOUDTRAIL_CLOUDWATCH_LOGS_ENABLED",
"driftStatusSummary": {
"driftStatus": "NOT_CHECKING"
},
"statusSummary": {
"status": "SUCCEEDED"
},
"targetIdentifier": "arn:aws:organizations::123456789012:ou/o-s64ryxxxxx/ou-oqxx-i5wnxxxx"
}
]
}
```
如需詳細資訊，請參閱《[AWS Control Tower 使用者指南》中的關於](https://docs.aws.amazon.com/controltower/latest/controlreference/controls.html) *AWS Control Tower 中的控制項*。
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [ListEnabledControls](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/list-enabled-controls.html)。
### `list-landing-zone-operations`
以下程式碼範例顯示如何使用 `list-landing-zone-operations`。
**AWS CLI**
**列出 Control Tower 登陸區域操作**
下列`list-landing-zone-operations`範例列出 AWS Control Tower 登陸區域操作。
```
aws controltower list-landing-zone-operations
```
輸出：
```
{
"landingZoneOperations": [
{
"operationIdentifier": "202ee056-5147-49fd-a7ad-8161e3bf043a",
"operationType": "RESET",
"status": "SUCCEEDED"
},
{
"operationIdentifier": "dbd4a4b1-baf9-48cc-bd71-6b923d0f2339",
"operationType": "RESET",
"status": "SUCCEEDED"
},
{
"operationIdentifier": "e6261ab8-3247-4052-af31-1afe7bb0593e",
"operationType": "UPDATE",
"status": "SUCCEEDED"
},
{
"operationIdentifier": "507c6c87-89a8-435f-8697-b257a800f129",
"operationType": "UPDATE",
"status": "SUCCEEDED"
}
]
}
```
如需詳細資訊，請參閱 [AWS Control Tower 使用者指南中的 Control Tower 入門](https://docs.aws.amazon.com/controltower/latest/userguide/getting-started-with-control-tower.html)。 *AWS *
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [ListLandingZoneOperations](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/list-landing-zone-operations.html)。
### `list-landing-zones`
以下程式碼範例顯示如何使用 `list-landing-zones`。
**AWS CLI**
**列出 Control Tower 登陸區域識別符**
下列`list-landing-zones`範例列出 Control Tower 登陸區域 `identifier`。
```
aws controltower list-landing-zones
```
輸出：
```
{
"landingZones": [
{
"arn": "arn:aws:controltower:us-east-1:123456789012:landingzone/13CJG46WZKXXX4X5"
}
]
}
```
如需詳細資訊，請參閱 [AWS Control Tower 使用者指南中的 Control Tower 入門](https://docs.aws.amazon.com/controltower/latest/userguide/getting-started-with-control-tower.html)。 *AWS *
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [ListLandingZones](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/list-landing-zones.html)。
### `list-tags-for-resource`
以下程式碼範例顯示如何使用 `list-tags-for-resource`。
**AWS CLI**
**列出已啟用 Control Tower 控制項的標籤**
下列`list-tags-for-resource`範例列出 AWS Control Tower Enabled Controls 的標籤。
```
aws controltower list-tags-for-resource \
--resource-arn {{"arn:aws:controltower:us-east-1:123456789012:enabledcontrol/2H2AWUG4SKG81855"}}
```
輸出：
```
{
"tags": {
"TestTagKey": "TestTagValue"
}
}
```
如需詳細資訊，請參閱《[AWS Control Tower 使用者指南》中的關於](https://docs.aws.amazon.com/controltower/latest/controlreference/controls.html) *AWS Control Tower 中的控制項*。
+ 如需 API 詳細資訊，請參閱《AWS CLI 命令參考》**中的 [ListTagsForResource](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/list-tags-for-resource.html)。
### `reset-enabled-baseline`
以下程式碼範例顯示如何使用 `reset-enabled-baseline`。
**AWS CLI**
**重設已啟用 Control Tower 的基準**
下列`reset-enabled-baseline`範例會重設已啟用 AWS Control Tower 的基準。
```
aws controltower reset-enabled-baseline \
--enabled-baseline-identifier {{arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XOM12BEL4YD578CQ2}}
```
輸出：
```
{
"operationIdentifier": "214cde95-5c39-46b9-b429-4fad550a7096"
}
```
如需詳細資訊，請參閱 *AWS Control Tower 使用者指南*中的[基準類型](https://docs.aws.amazon.com/controltower/latest/userguide/types-of-baselines.html)。
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [ResetEnabledBaseline](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/reset-enabled-baseline.html)。
### `reset-enabled-control`
以下程式碼範例顯示如何使用 `reset-enabled-control`。
**AWS CLI**
**重設已啟用 Control Tower 的控制項**
下列`reset-enabled-control`範例會重設已啟用 AWS Control Tower 的控制項。
```
aws controltower reset-enabled-control \
--enabled-control-identifier {{arn:aws:controltower:us-east-1:123456789012:enabledcontrol/2H2AWUG4SKG81855}}
```
輸出：
```
{
"operationIdentifier": "8276XXXX-b4XX-4eXX-96XX-881d2a4XXXXX"
}
```
如需詳細資訊，請參閱《[AWS Control Tower 使用者指南》中的關於](https://docs.aws.amazon.com/controltower/latest/controlreference/controls.html) *AWS Control Tower 中的控制項*。
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [ResetEnabledControl](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/reset-enabled-control.html)。
### `reset-landing-zone`
以下程式碼範例顯示如何使用 `reset-landing-zone`。
**AWS CLI**
**重設 Control Tower 登陸區域**
下列`reset-landing-zone`範例會重設 AWS Control Tower 登陸區域。
```
aws controltower reset-landing-zone \
--landing-zone-identifier {{arn:aws:controltower:us-east-1:123456789012:landingzone/13CJG46WZKXXX4X5}}
```
輸出：
```
{
"operationIdentifier": "73XXXXXX-b2XX-77XX-c6XX-374XXXXXXXXX"
}
```
如需詳細資訊，請參閱 [AWS Control Tower 使用者指南中的 Control Tower 入門](https://docs.aws.amazon.com/controltower/latest/userguide/getting-started-with-control-tower.html)。 *AWS *
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [ResetLandingZone](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/reset-landing-zone.html)。
### `tag-resource`
以下程式碼範例顯示如何使用 `tag-resource`。
**AWS CLI**
**標記已啟用 Control Tower 的控制項**
下列`tag-resource`範例會標記已啟用 AWS Control Tower 的控制項。
```
aws controltower tag-resource \
--resource-arn {{"arn:aws:controltower:us-east-1:123456789012:enabledcontrol/2H2AWUG4SKG81855"}} \
--tags {{"TestTagKey=TestTagValue"}}
```
此命令不會產生輸出。
如需詳細資訊，請參閱 Control [Tower 使用者指南中的關於 AWS Control](https://docs.aws.amazon.com/controltower/latest/controlreference/controls.html) Tower 中的控制項。 *AWS *
+ 如需 API 詳細資訊，請參閱《AWS CLI 命令參考》**中的 [TagResource](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/tag-resource.html)。
### `untag-resource`
以下程式碼範例顯示如何使用 `untag-resource`。
**AWS CLI**
**取消標記已啟用 Control Tower 的控制項**
下列`untag-resource`範例會取消標記已啟用 AWS Control Tower 的控制項。
```
aws controltower untag-resource \
--resource-arn {{"arn:aws:controltower:us-east-1:123456789012:enabledcontrol/2H2AWUG4SKG81855"}} \
--tag-keys {{"TestTagKey"}}
```
此命令不會產生輸出。
如需詳細資訊，請參閱 Control [Tower 使用者指南中的關於 AWS Control](https://docs.aws.amazon.com/controltower/latest/controlreference/controls.html) Tower 中的控制項。 *AWS *
+ 如需 API 詳細資訊，請參閱《AWS CLI 命令參考》**中的 [UntagResource](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/untag-resource.html)。
### `update-enabled-baseline`
以下程式碼範例顯示如何使用 `update-enabled-baseline`。
**AWS CLI**
**範例 1：更新已停用的 Control Tower 基準**
如果基準 'IdentityCenterBaseline' 已停用，下列`update-enabled-baseline`範例會更新已啟用 AWS Control Tower 的基準。
```
aws controltower update-enabled-baseline \
--baseline-version {{4.0}} \
--enabled-baseline-identifier {{arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XOM12BEL4YD578CQ2}}
```
輸出：
```
{
"operationIdentifier": "214cde95-5c39-46b9-b429-4fad550a7096"
}
```
**範例 2：更新已啟用的 Control Tower 基準**
如果已啟用基準 'IdentityCenterBaseline'，以下`update-enabled-baseline`範例會更新已啟用 AWS Control Tower 的基準。
```
aws controltower update-enabled-baseline \
--baseline-version {{4.0}} \
--enabled-baseline-identifier {{arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XOM12BEL4YD578CQ2}} \
--parameters '{{[{"key":"IdentityCenterEnabledBaselineArn","value":"arn:aws:controltower:us-east-1:123456789012:enabledbaseline/XAJNZNCBC1I386C7B"}]}}'
```
輸出：
```
{
"operationIdentifier": "b0f4a7c2-334d-48d9-971e-47fea9db3e8b"
}
```
如需詳細資訊，請參閱 *AWS Control Tower 使用者指南*中的[基準類型](https://docs.aws.amazon.com/controltower/latest/userguide/types-of-baselines.html)。
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [UpdateEnabledBaseline](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/update-enabled-baseline.html)。
### `update-enabled-control`
以下程式碼範例顯示如何使用 `update-enabled-control`。
**AWS CLI**
**更新已啟用 Control Tower 的控制項**
下列`update-enabled-control`範例會更新已啟用 AWS Control Tower 的控制項。
```
aws controltower update-enabled-control \
--enabled-control-identifier {{arn:aws:controltower:us-east-1:123456789012:enabledcontrol/JSJN8UL0G2MWGRTZ}} \
--parameters '{{[{"key":"AllowedRegions","value":["us-east-1","us-west-1","us-west-2","us-east-2"]}]}}'
```
輸出：
```
{
"operationIdentifier": "b8f0dxxx-08xx-43xx-a2xx-568e9922xxxx"
}
```
如需詳細資訊，請參閱 Control [Tower 使用者指南中的關於 AWS Control](https://docs.aws.amazon.com/controltower/latest/controlreference/controls.html) Tower 中的控制項。 *AWS *
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [UpdateEnabledControl](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/update-enabled-control.html)。
### `update-landing-zone`
以下程式碼範例顯示如何使用 `update-landing-zone`。
**AWS CLI**
**更新 Control Tower 登陸區域**
下列`update-landing-zone`範例會更新 AWS Control Tower 登陸區域。
```
aws controltower update-landing-zone \
--landing-zone-identifier {{arn:aws:controltower:us-east-1:123456789012:landingzone/13CJG46WZKXXX4X5}} \
--landing-zone-version {{3.3}} \
--manifest {{"file://UpdateLandingZoneManifest.json"}}
```
輸出：
```
{
"operationIdentifier": "53XXXXXX-b2XX-97XX-c6XX-474XXXXXXXXX"
}
```
如需詳細資訊，請參閱 [AWS Control Tower 使用者指南中的 Control Tower 入門](https://docs.aws.amazon.com/controltower/latest/userguide/getting-started-with-control-tower.html)。 *AWS *
+ 如需 API 詳細資訊，請參閱《 *AWS CLI 命令參考*》中的 [UpdateLandingZone](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/controltower/update-landing-zone.html)。