CTS Auditing

Scenarios

RGC supports the recording of RGC operations through CTS. You can query RGC traces and use them for historical operation audits and backtracks.

Prerequisites

CTS has been enabled.

Key RGC Operations Recorded by CTS

**Table 1** RGC operations that can be recorded by CTS
Operation	Resource Type	Trace Name
Performing checks before setting up a landing zone	LandingZone	checkLaunch
Deleting a landing zone	LandingZone	deleteLandingZone
Setting up a landing zone	LandingZone	setupLandingZone
Disabling a governance policy	Control	DisableGovernancePolicy
Enabling a governance policy	Control	EnableGovernancePolicy
Creating an account	Account	createAccount
Enrolling an account	Account	enrollAccount
Unmanaging an account	Account	unEnrollAccount
Updating an enrolled account	Account	updateManagedAccount
Creating an OU	OrganizationUnit	createManagedOrganizationalUnit
Deleting an OU	OrganizationUnit	deleteManagedOrganizationalUnits
Re-registering an OU	OrganizationUnit	reRegisterOrganizationalUnit
Registering an OU	OrganizationUnit	registerOrganizationalUnit
Deregistering an OU	OrganizationUnit	deregisterOrganizationalUnit
Creating a template.	Template	createTemplate
Deleting a template	Template	deleteTemplate
Listing governance policies	governancePolicy	ListControls
Listing non-compliant resources	governancePolicy	ListControlViolations
Querying details about a governance policy	governancePolicy	ShowControl
Querying the status of a governance policy	governancePolicy	ShowControlOperate
Listing enabled governance policies	governancePolicy	ListEnabledControls
Listing governance policies enabled for a registered OU	governancePolicy	ListControlsForOrganizationalUnit
Listing governance policies enabled for an enrolled account	governancePolicy	ListControlsForAccount
Querying the compliance status of an enrolled account	ComplianceStatus	ShowComplianceStatusForAccount
Querying the compliance status of a registered OU	ComplianceStatus	ShowComplianceStatusForOrganizationalUnit
Querying a governance policy enabled for a registered OU	governancePolicy	ShowControlsForOrganizationalUnit
Querying a governance policy enabled for an enrolled account	governancePolicy	ShowControlsForAccount
Querying the compliance against Config rules for enrolled accounts	ComplianceStatus	ListConfigRuleCompliances
Querying the compliance against external Config rules for enrolled accounts	ComplianceStatus	ListExternalConfigRuleCompliances
Listing drift information	Drift	ListDriftDetails
Querying registration information	operation	ShowOperation
Querying registered OUs	OrganizationUnit	ShowManagedOrganizationalUnit
Listing registered OUs enabled with governance policies	OrganizationUnit	ListManagedOrganizationalUnits
Querying information about an enrolled account	Account	ShowManagedAccount
Listing enrolled accounts in a registered OU	Account	ListManagedAccountsForParent
Listing enrolled accounts enabled with governance policies	Account	ListManagedAccounts
Listing enrolled core accounts	Account	ShowManagedCoreAccount
Querying the home region	Region	ShowHomeRegion
Querying the setup status of a landing zone	LandingZone	ShowLandingZoneStatus
Checking available landing zone updates	LandingZone	ShowAvailableUpdates
Querying configurations of a landing zone	LandingZone	ShowLandingZoneConfiguration
Querying IAM Identity Center user information	LandingZone	ShowLandingZoneIdentityCenter
Querying operations on registered OUs and enrolled accounts	operation	ListOperation
Querying template deployment parameters	Template	ShowTemplateDeployParams
Querying predefined templates	Template	ListPredefinedTemplates
Querying the template information of an enrolled account	Template	ShowManagedAccountTemplate
Querying the status of the latest governance check	BestPractice	ShowBestPracticeStatus
Querying the overview of the latest successful governance check	BestPractice	ShowBestPracticeOverview
Querying account details for governance check	BestPractice	ShowBestPracticeAccountInfo