{
  "version":"2.0",
  "metadata":{
    "apiVersion":"2018-05-10",
    "auth":["aws.auth#sigv4"],
    "endpointPrefix":"controlcatalog",
    "protocol":"rest-json",
    "protocols":["rest-json"],
    "serviceFullName":"AWS Control Catalog",
    "serviceId":"ControlCatalog",
    "signatureVersion":"v4",
    "signingName":"controlcatalog",
    "uid":"controlcatalog-2018-05-10"
  },
  "operations":{
    "GetControl":{
      "name":"GetControl",
      "http":{
        "method":"POST",
        "requestUri":"/get-control",
        "responseCode":200
      },
      "input":{"shape":"GetControlRequest"},
      "output":{"shape":"GetControlResponse"},
      "errors":[
        {"shape":"ResourceNotFoundException"},
        {"shape":"AccessDeniedException"},
        {"shape":"InternalServerException"},
        {"shape":"ValidationException"},
        {"shape":"ThrottlingException"}
      ],
      "documentation":"<p>Returns details about a specific control, most notably a list of Amazon Web Services Regions where this control is supported. Input a value for the <i>ControlArn</i> parameter, in ARN form. <code>GetControl</code> accepts <i>controltower</i> or <i>controlcatalog</i> control ARNs as input. Returns a <i>controlcatalog</i> ARN format.</p> <p>In the API response, controls that have the value <code>GLOBAL</code> in the <code>Scope</code> field do not show the <code>DeployableRegions</code> field, because it does not apply. Controls that have the value <code>REGIONAL</code> in the <code>Scope</code> field return a value for the <code>DeployableRegions</code> field, as shown in the example.</p>",
      "readonly":true
    },
    "ListCommonControls":{
      "name":"ListCommonControls",
      "http":{
        "method":"POST",
        "requestUri":"/common-controls",
        "responseCode":200
      },
      "input":{"shape":"ListCommonControlsRequest"},
      "output":{"shape":"ListCommonControlsResponse"},
      "errors":[
        {"shape":"AccessDeniedException"},
        {"shape":"InternalServerException"},
        {"shape":"ValidationException"},
        {"shape":"ThrottlingException"}
      ],
      "documentation":"<p>Returns a paginated list of common controls from the Amazon Web Services Control Catalog.</p> <p>You can apply an optional filter to see common controls that have a specific objective. If you don’t provide a filter, the operation returns all common controls. </p>",
      "readonly":true
    },
    "ListControlMappings":{
      "name":"ListControlMappings",
      "http":{
        "method":"POST",
        "requestUri":"/list-control-mappings",
        "responseCode":200
      },
      "input":{"shape":"ListControlMappingsRequest"},
      "output":{"shape":"ListControlMappingsResponse"},
      "errors":[
        {"shape":"AccessDeniedException"},
        {"shape":"InternalServerException"},
        {"shape":"ValidationException"},
        {"shape":"ThrottlingException"}
      ],
      "documentation":"<p>Returns a paginated list of control mappings from the Control Catalog. Control mappings show relationships between controls and other entities, such as common controls or compliance frameworks.</p>",
      "readonly":true
    },
    "ListControls":{
      "name":"ListControls",
      "http":{
        "method":"POST",
        "requestUri":"/list-controls",
        "responseCode":200
      },
      "input":{"shape":"ListControlsRequest"},
      "output":{"shape":"ListControlsResponse"},
      "errors":[
        {"shape":"AccessDeniedException"},
        {"shape":"InternalServerException"},
        {"shape":"ValidationException"},
        {"shape":"ThrottlingException"}
      ],
      "documentation":"<p>Returns a paginated list of all available controls in the Control Catalog library. Allows you to discover available controls. The list of controls is given as structures of type <i>controlSummary</i>. The ARN is returned in the global <i>controlcatalog</i> format, as shown in the examples.</p>",
      "readonly":true
    },
    "ListDomains":{
      "name":"ListDomains",
      "http":{
        "method":"POST",
        "requestUri":"/domains",
        "responseCode":200
      },
      "input":{"shape":"ListDomainsRequest"},
      "output":{"shape":"ListDomainsResponse"},
      "errors":[
        {"shape":"AccessDeniedException"},
        {"shape":"InternalServerException"},
        {"shape":"ValidationException"},
        {"shape":"ThrottlingException"}
      ],
      "documentation":"<p>Returns a paginated list of domains from the Control Catalog.</p>",
      "readonly":true
    },
    "ListObjectives":{
      "name":"ListObjectives",
      "http":{
        "method":"POST",
        "requestUri":"/objectives",
        "responseCode":200
      },
      "input":{"shape":"ListObjectivesRequest"},
      "output":{"shape":"ListObjectivesResponse"},
      "errors":[
        {"shape":"AccessDeniedException"},
        {"shape":"InternalServerException"},
        {"shape":"ValidationException"},
        {"shape":"ThrottlingException"}
      ],
      "documentation":"<p>Returns a paginated list of objectives from the Control Catalog.</p> <p>You can apply an optional filter to see the objectives that belong to a specific domain. If you don’t provide a filter, the operation returns all objectives. </p>",
      "readonly":true
    }
  },
  "shapes":{
    "AccessDeniedException":{
      "type":"structure",
      "members":{
        "Message":{"shape":"String"}
      },
      "documentation":"<p>You do not have sufficient access to perform this action.</p>",
      "error":{
        "httpStatusCode":403,
        "senderFault":true
      },
      "exception":true
    },
    "AssociatedDomainSummary":{
      "type":"structure",
      "members":{
        "Arn":{
          "shape":"DomainArn",
          "documentation":"<p>The Amazon Resource Name (ARN) of the related domain.</p>"
        },
        "Name":{
          "shape":"String",
          "documentation":"<p>The name of the related domain.</p>"
        }
      },
      "documentation":"<p>A summary of the domain that a common control or an objective belongs to.</p>"
    },
    "AssociatedObjectiveSummary":{
      "type":"structure",
      "members":{
        "Arn":{
          "shape":"ObjectiveArn",
          "documentation":"<p>The Amazon Resource Name (ARN) of the related objective.</p>"
        },
        "Name":{
          "shape":"String",
          "documentation":"<p>The name of the related objective.</p>"
        }
      },
      "documentation":"<p>A summary of the objective that a common control supports.</p>"
    },
    "CommonControlArn":{
      "type":"string",
      "max":2048,
      "min":41,
      "pattern":"arn:(aws(?:[-a-z]*)?):controlcatalog:::common-control/[0-9a-z]+"
    },
    "CommonControlArnFilterList":{
      "type":"list",
      "member":{"shape":"CommonControlArn"},
      "max":1,
      "min":1
    },
    "CommonControlFilter":{
      "type":"structure",
      "members":{
        "Objectives":{
          "shape":"ObjectiveResourceFilterList",
          "documentation":"<p>The objective that's used as filter criteria.</p> <p>You can use this parameter to specify one objective ARN at a time. Passing multiple ARNs in the <code>CommonControlFilter</code> isn’t supported.</p>"
        }
      },
      "documentation":"<p>An optional filter that narrows the results to a specific objective.</p>"
    },
    "CommonControlMappingDetails":{
      "type":"structure",
      "required":["CommonControlArn"],
      "members":{
        "CommonControlArn":{
          "shape":"CommonControlArn",
          "documentation":"<p>The Amazon Resource Name (ARN) that identifies the common control in the mapping.</p>"
        }
      },
      "documentation":"<p>A structure that contains details about a common control mapping. In particular, it returns the Amazon Resource Name (ARN) of the common control.</p>"
    },
    "CommonControlSummary":{
      "type":"structure",
      "required":[
        "Arn",
        "Name",
        "Description",
        "Domain",
        "Objective",
        "CreateTime",
        "LastUpdateTime"
      ],
      "members":{
        "Arn":{
          "shape":"CommonControlArn",
          "documentation":"<p>The Amazon Resource Name (ARN) that identifies the common control.</p>"
        },
        "Name":{
          "shape":"String",
          "documentation":"<p>The name of the common control.</p>"
        },
        "Description":{
          "shape":"String",
          "documentation":"<p>The description of the common control.</p>"
        },
        "Domain":{
          "shape":"AssociatedDomainSummary",
          "documentation":"<p>The domain that the common control belongs to.</p>"
        },
        "Objective":{
          "shape":"AssociatedObjectiveSummary",
          "documentation":"<p>The objective that the common control belongs to.</p>"
        },
        "CreateTime":{
          "shape":"Timestamp",
          "documentation":"<p>The time when the common control was created.</p>"
        },
        "LastUpdateTime":{
          "shape":"Timestamp",
          "documentation":"<p>The time when the common control was most recently updated.</p>"
        }
      },
      "documentation":"<p>A summary of metadata for a common control.</p>"
    },
    "CommonControlSummaryList":{
      "type":"list",
      "member":{"shape":"CommonControlSummary"}
    },
    "ControlAlias":{
      "type":"string",
      "pattern":"[a-zA-Z0-9](?:[a-zA-Z0-9_.-]{0,254}[a-zA-Z0-9])"
    },
    "ControlAliases":{
      "type":"list",
      "member":{"shape":"ControlAlias"}
    },
    "ControlArn":{
      "type":"string",
      "max":2048,
      "min":34,
      "pattern":"arn:(aws(?:[-a-z]*)?):(controlcatalog|controltower):[a-zA-Z0-9-]*::control/[0-9a-zA-Z_\\-]+"
    },
    "ControlArnFilterList":{
      "type":"list",
      "member":{"shape":"ControlArn"},
      "max":1,
      "min":1
    },
    "ControlBehavior":{
      "type":"string",
      "enum":[
        "PREVENTIVE",
        "PROACTIVE",
        "DETECTIVE"
      ]
    },
    "ControlFilter":{
      "type":"structure",
      "members":{
        "Implementations":{
          "shape":"ImplementationFilter",
          "documentation":"<p>A filter that narrows the results to controls with specific implementation types or identifiers. This field allows you to find controls that are implemented by specific Amazon Web Services services or with specific service identifiers.</p>"
        },
        "GovernedProviders":{
          "shape":"GovernedProviderFilterList",
          "documentation":"<p>A filter that narrows the results to controls that govern a specific provider's resources.</p>"
        }
      },
      "documentation":"<p>A structure that defines filtering criteria for the ListControls operation. You can use this filter to narrow down the list of controls based on their implementation details.</p>"
    },
    "ControlMapping":{
      "type":"structure",
      "required":[
        "ControlArn",
        "MappingType",
        "Mapping"
      ],
      "members":{
        "ControlArn":{
          "shape":"ControlArn",
          "documentation":"<p>The Amazon Resource Name (ARN) that identifies the control in the mapping.</p>"
        },
        "MappingType":{
          "shape":"MappingType",
          "documentation":"<p>The type of mapping relationship between the control and other entities.</p>"
        },
        "Mapping":{
          "shape":"Mapping",
          "documentation":"<p>The details of the mapping relationship, for example, containing framework, common control, or related control information.</p>"
        }
      },
      "documentation":"<p>A structure that contains information about a control mapping, including the control ARN, mapping type, and mapping details.</p>"
    },
    "ControlMappingFilter":{
      "type":"structure",
      "members":{
        "ControlArns":{
          "shape":"ControlArnFilterList",
          "documentation":"<p>A list of control ARNs to filter the mappings. When specified, only mappings associated with these controls are returned.</p>"
        },
        "CommonControlArns":{
          "shape":"CommonControlArnFilterList",
          "documentation":"<p>A list of common control ARNs to filter the mappings. When specified, only mappings associated with these common controls are returned.</p>"
        },
        "MappingTypes":{
          "shape":"MappingTypeFilterList",
          "documentation":"<p>A list of mapping types to filter the mappings. When specified, only mappings of these types are returned.</p>"
        }
      },
      "documentation":"<p>A structure that defines filtering criteria for the ListControlMappings operation. You can use this filter to narrow down the list of control mappings based on control ARNs, common control ARNs, or mapping types.</p>"
    },
    "ControlMappings":{
      "type":"list",
      "member":{"shape":"ControlMapping"}
    },
    "ControlParameter":{
      "type":"structure",
      "required":["Name"],
      "members":{
        "Name":{
          "shape":"String",
          "documentation":"<p>The parameter name. This name is the parameter <code>key</code> when you call <a href=\"https://docs.aws.amazon.com/controltower/latest/APIReference/API_EnableControl.html\"> <code>EnableControl</code> </a> or <a href=\"https://docs.aws.amazon.com/controltower/latest/APIReference/API_UpdateEnabledControl.html\"> <code>UpdateEnabledControl</code> </a>.</p>"
        },
        "Requirement":{
          "shape":"ControlParameterRequirement",
          "documentation":"<p>Indicates whether the parameter is required or optional when you enable the control.</p>"
        }
      },
      "documentation":"<p>Five types of control parameters are supported.</p> <ul> <li> <p> <b>AllowedRegions</b>: List of Amazon Web Services Regions exempted from the control. Each string is expected to be an Amazon Web Services Region code. This parameter is mandatory for the <b>OU Region deny</b> control, <b>CT.MULTISERVICE.PV.1</b>.</p> <p>Example: <code>[\"us-east-1\",\"us-west-2\"]</code> </p> </li> <li> <p> <b>ExemptedActions</b>: List of Amazon Web Services IAM actions exempted from the control. Each string is expected to be an IAM action.</p> <p>Example: <code>[\"logs:DescribeLogGroups\",\"logs:StartQuery\",\"logs:GetQueryResults\"]</code> </p> </li> <li> <p> <b>ExemptedPrincipalArns</b>: List of Amazon Web Services IAM principal ARNs exempted from the control. Each string is expected to be an IAM principal that follows the format <code>arn:partition:service::account:resource</code> </p> <p>Example: <code>[\"arn:aws:iam::*:role/ReadOnly\",\"arn:aws:sts::*:assumed-role/ReadOnly/*\"]</code> </p> </li> <li> <p> <b>ExemptedResourceArns</b>: List of resource ARNs exempted from the control. Each string is expected to be a resource ARN.</p> <p>Example: <code>[\"arn:aws:s3:::my-bucket-name\"]</code> </p> </li> <li> <p> <b>ExemptAssumeRoot</b>: A parameter that lets you choose whether to exempt requests made with <code>AssumeRoot</code> from this control, for this OU. For member accounts, the <code>AssumeRoot</code> property is included in requests initiated by IAM centralized root access. This parameter applies only to the <code>AWS-GR_RESTRICT_ROOT_USER</code> control. If you add the parameter when enabling the control, the <code>AssumeRoot</code> exemption is allowed. If you omit the parameter, the <code>AssumeRoot</code> exception is not permitted. The parameter does not accept <code>False</code> as a value.</p> <p> <i>Example: Enabling the control and allowing <code>AssumeRoot</code> </i> </p> <p> <code>{ \"controlIdentifier\": \"arn:aws:controlcatalog:::control/5kvme4m5d2b4d7if2fs5yg2ui\", \"parameters\": [ { \"key\": \"ExemptAssumeRoot\", \"value\": true } ], \"targetIdentifier\": \"arn:aws:organizations::8633900XXXXX:ou/o-6jmn81636m/ou-qsah-jtiihcla\" }</code> </p> </li> </ul>"
    },
    "ControlParameterRequirement":{
      "type":"string",
      "enum":[
        "REQUIRED",
        "OPTIONAL"
      ]
    },
    "ControlParameters":{
      "type":"list",
      "member":{"shape":"ControlParameter"}
    },
    "ControlRelationType":{
      "type":"string",
      "enum":[
        "COMPLEMENTARY",
        "ALTERNATIVE",
        "MUTUALLY_EXCLUSIVE"
      ]
    },
    "ControlScope":{
      "type":"string",
      "enum":[
        "GLOBAL",
        "REGIONAL"
      ]
    },
    "ControlSeverity":{
      "type":"string",
      "enum":[
        "LOW",
        "MEDIUM",
        "HIGH",
        "CRITICAL"
      ]
    },
    "ControlSummary":{
      "type":"structure",
      "required":[
        "Arn",
        "Name",
        "Description"
      ],
      "members":{
        "Arn":{
          "shape":"ControlArn",
          "documentation":"<p>The Amazon Resource Name (ARN) of the control.</p>"
        },
        "Aliases":{
          "shape":"ControlAliases",
          "documentation":"<p>A list of alternative identifiers for the control. These are human-readable designators, such as <code>SH.S3.1</code>. Several aliases can refer to the same control across different Amazon Web Services services or compliance frameworks.</p>"
        },
        "Name":{
          "shape":"String",
          "documentation":"<p>The display name of the control.</p>"
        },
        "Description":{
          "shape":"String",
          "documentation":"<p>A description of the control, as it may appear in the console. Describes the functionality of the control.</p>"
        },
        "Behavior":{
          "shape":"ControlBehavior",
          "documentation":"<p>An enumerated type, with the following possible values:</p>"
        },
        "Severity":{
          "shape":"ControlSeverity",
          "documentation":"<p>An enumerated type, with the following possible values:</p>"
        },
        "ParameterRequirementSummary":{
          "shape":"ParameterRequirementSummary",
          "documentation":"<p>A summary that indicates whether the control requires parameters, accepts optional parameters, or does not support parameters. Use this field to determine whether you need to supply parameter values when you enable the control.</p>"
        },
        "Implementation":{
          "shape":"ImplementationSummary",
          "documentation":"<p>An object of type <code>ImplementationSummary</code> that describes how the control is implemented.</p>"
        },
        "CreateTime":{
          "shape":"Timestamp",
          "documentation":"<p>A timestamp that notes the time when the control was released (start of its life) as a governance capability in Amazon Web Services.</p>"
        },
        "GovernedResources":{
          "shape":"GovernedResources",
          "documentation":"<p>A list of resource types that are governed by this control. This information helps you understand which controls can govern certain types of resources, and conversely, which resources are affected when the control is implemented. For Amazon Web Services controls, the resources are represented as CloudFormation resource types. For non-Amazon Web Services controls, the resources are represented in a provider-specific format. If <code>GovernedResources</code> cannot be represented by available resource types, it’s returned as an empty list.</p>"
        },
        "GovernedProviders":{
          "shape":"GovernedProviders",
          "documentation":"<p>A list of providers whose resources are governed by this control. For example, a value of <code>AWS</code> indicates that the control governs Amazon Web Services resources.</p>"
        }
      },
      "documentation":"<p>Overview of information about a control.</p>"
    },
    "Controls":{
      "type":"list",
      "member":{"shape":"ControlSummary"}
    },
    "DeployableRegions":{
      "type":"list",
      "member":{"shape":"RegionCode"}
    },
    "DomainArn":{
      "type":"string",
      "max":2048,
      "min":33,
      "pattern":"arn:(aws(?:[-a-z]*)?):controlcatalog:::domain/[0-9a-z]+"
    },
    "DomainResourceFilter":{
      "type":"structure",
      "members":{
        "Arn":{
          "shape":"DomainArn",
          "documentation":"<p>The Amazon Resource Name (ARN) of the domain.</p>"
        }
      },
      "documentation":"<p>The domain resource that's being used as a filter.</p>"
    },
    "DomainResourceFilterList":{
      "type":"list",
      "member":{"shape":"DomainResourceFilter"}
    },
    "DomainSummary":{
      "type":"structure",
      "required":[
        "Arn",
        "Name",
        "Description",
        "CreateTime",
        "LastUpdateTime"
      ],
      "members":{
        "Arn":{
          "shape":"DomainArn",
          "documentation":"<p>The Amazon Resource Name (ARN) that identifies the domain.</p>"
        },
        "Name":{
          "shape":"String",
          "documentation":"<p>The name of the domain.</p>"
        },
        "Description":{
          "shape":"String",
          "documentation":"<p>The description of the domain.</p>"
        },
        "CreateTime":{
          "shape":"Timestamp",
          "documentation":"<p>The time when the domain was created.</p>"
        },
        "LastUpdateTime":{
          "shape":"Timestamp",
          "documentation":"<p>The time when the domain was most recently updated.</p>"
        }
      },
      "documentation":"<p>A summary of metadata for a domain.</p>"
    },
    "DomainSummaryList":{
      "type":"list",
      "member":{"shape":"DomainSummary"}
    },
    "FrameworkItem":{
      "type":"string",
      "max":250,
      "min":3
    },
    "FrameworkMappingDetails":{
      "type":"structure",
      "required":[
        "Name",
        "Item"
      ],
      "members":{
        "Name":{
          "shape":"FrameworkName",
          "documentation":"<p>The name of the compliance framework that the control maps to.</p>"
        },
        "Item":{
          "shape":"FrameworkItem",
          "documentation":"<p>The specific item or requirement within the framework that the control maps to.</p>"
        }
      },
      "documentation":"<p>A structure that contains details about a framework mapping, including the framework name and specific item within the framework that the control maps to.</p>"
    },
    "FrameworkName":{
      "type":"string",
      "max":250,
      "min":3
    },
    "GetControlRequest":{
      "type":"structure",
      "required":["ControlArn"],
      "members":{
        "ControlArn":{
          "shape":"ControlArn",
          "documentation":"<p>The Amazon Resource Name (ARN) of the control. It has one of the following formats:</p> <p> <i>Global format</i> </p> <p> <code>arn:{PARTITION}:controlcatalog:::control/{CONTROL_CATALOG_OPAQUE_ID}</code> </p> <p> <i>Or Regional format</i> </p> <p> <code>arn:{PARTITION}:controltower:{REGION}::control/{CONTROL_TOWER_OPAQUE_ID}</code> </p> <p>Here is a more general pattern that covers Amazon Web Services Control Tower and Control Catalog ARNs:</p> <p> <code>^arn:(aws(?:[-a-z]*)?):(controlcatalog|controltower):[a-zA-Z0-9-]*::control/[0-9a-zA-Z_\\\\-]+$</code> </p>"
        }
      }
    },
    "GetControlResponse":{
      "type":"structure",
      "required":[
        "Arn",
        "Name",
        "Description",
        "Behavior",
        "RegionConfiguration"
      ],
      "members":{
        "Arn":{
          "shape":"ControlArn",
          "documentation":"<p>The Amazon Resource Name (ARN) of the control.</p>"
        },
        "Aliases":{
          "shape":"ControlAliases",
          "documentation":"<p>A list of alternative identifiers for the control. These are human-readable designators, such as <code>SH.S3.1</code>. Several aliases can refer to the same control across different Amazon Web Services services or compliance frameworks.</p>"
        },
        "Name":{
          "shape":"String",
          "documentation":"<p>The display name of the control.</p>"
        },
        "Description":{
          "shape":"String",
          "documentation":"<p>A description of what the control does.</p>"
        },
        "Behavior":{
          "shape":"ControlBehavior",
          "documentation":"<p>A term that identifies the control's functional behavior. One of <code>Preventive</code>, <code>Detective</code>, <code>Proactive</code> </p>"
        },
        "Severity":{
          "shape":"ControlSeverity",
          "documentation":"<p>An enumerated type, with the following possible values:</p>"
        },
        "RegionConfiguration":{"shape":"RegionConfiguration"},
        "Implementation":{
          "shape":"ImplementationDetails",
          "documentation":"<p>Returns information about the control, as an <code>ImplementationDetails</code> object that shows the underlying implementation type for a control.</p>"
        },
        "ParameterRequirementSummary":{
          "shape":"ParameterRequirementSummary",
          "documentation":"<p>A summary that indicates whether the control requires parameters, accepts optional parameters, or does not support parameters. Use this field to determine whether you need to supply parameter values when you enable the control.</p>"
        },
        "Parameters":{
          "shape":"ControlParameters",
          "documentation":"<p>Returns an array of <code>ControlParameter</code> objects that specify the parameters a control supports. An empty list is returned for controls that don’t support parameters. </p>"
        },
        "CreateTime":{
          "shape":"Timestamp",
          "documentation":"<p>A timestamp that notes the time when the control was released (start of its life) as a governance capability in Amazon Web Services.</p>"
        },
        "GovernedResources":{
          "shape":"GovernedResources",
          "documentation":"<p>A list of resource types that are governed by this control. This information helps you understand which controls can govern certain types of resources, and conversely, which resources are affected when the control is implemented. For Amazon Web Services controls, the resources are represented as CloudFormation resource types. For non-Amazon Web Services controls, the resources are represented in a provider-specific format. If <code>GovernedResources</code> cannot be represented by available resource types, it’s returned as an empty list.</p>"
        },
        "GovernedProviders":{
          "shape":"GovernedProviders",
          "documentation":"<p>A list of providers whose resources are governed by this control. For example, a value of <code>AWS</code> indicates that the control governs Amazon Web Services resources.</p>"
        }
      }
    },
    "GovernedProvider":{
      "type":"string",
      "max":64,
      "min":2,
      "pattern":"[A-Z]{2,64}"
    },
    "GovernedProviderFilterList":{
      "type":"list",
      "member":{"shape":"GovernedProvider"},
      "max":1,
      "min":1
    },
    "GovernedProviders":{
      "type":"list",
      "member":{"shape":"GovernedProvider"}
    },
    "GovernedResource":{
      "type":"string",
      "pattern":"[A-Za-z0-9][A-Za-z0-9.:/_-]{1,254}"
    },
    "GovernedResources":{
      "type":"list",
      "member":{"shape":"GovernedResource"}
    },
    "ImplementationDetails":{
      "type":"structure",
      "required":["Type"],
      "members":{
        "Type":{
          "shape":"ImplementationType",
          "documentation":"<p>A string that describes a control's implementation type.</p>"
        },
        "Identifier":{
          "shape":"ImplementationIdentifier",
          "documentation":"<p>A service-specific identifier for the control, assigned by the service that implemented the control. For example, this identifier could be an Amazon Web Services Config Rule ID or a Security Hub Control ID.</p>"
        }
      },
      "documentation":"<p>An object that describes the implementation type for a control.</p> <p>Our <code>ImplementationDetails</code> <code>Type</code> format has three required segments:</p> <ul> <li> <p> <code>SERVICE-PROVIDER::SERVICE-NAME::RESOURCE-NAME</code> </p> </li> </ul> <p>For example, <code>AWS::Config::ConfigRule</code> <b>or</b> <code>AWS::SecurityHub::SecurityControl</code> resources have the format with three required segments.</p> <p>Our <code>ImplementationDetails</code> <code>Type</code> format has an optional fourth segment, which is present for applicable implementation types. The format is as follows: </p> <ul> <li> <p> <code>SERVICE-PROVIDER::SERVICE-NAME::RESOURCE-NAME::RESOURCE-TYPE-DESCRIPTION</code> </p> </li> </ul> <p>For example, <code>AWS::Organizations::Policy::SERVICE_CONTROL_POLICY</code> <b>or</b> <code>AWS::CloudFormation::Type::HOOK</code> have the format with four segments.</p> <p>Although the format is similar, the values for the <code>Type</code> field do not match any Amazon Web Services CloudFormation values.</p>"
    },
    "ImplementationFilter":{
      "type":"structure",
      "members":{
        "Types":{
          "shape":"ImplementationTypeFilterList",
          "documentation":"<p>A list of implementation types that can serve as filters. For example, you can filter for controls implemented as Amazon Web Services Config Rules by specifying AWS::Config::ConfigRule as a type.</p>"
        },
        "Identifiers":{
          "shape":"ImplementationIdentifierFilterList",
          "documentation":"<p>A list of service-specific identifiers that can serve as filters. For example, you can filter for controls with specific Amazon Web Services Config Rule IDs or Security Hub Control IDs.</p>"
        }
      },
      "documentation":"<p>A structure that defines filtering criteria for control implementations. You can use this filter to find controls that are implemented by specific Amazon Web Services services or with specific service identifiers.</p>"
    },
    "ImplementationIdentifier":{
      "type":"string",
      "max":256,
      "min":1,
      "pattern":"[a-zA-Z0-9_\\.-]+"
    },
    "ImplementationIdentifierFilterList":{
      "type":"list",
      "member":{"shape":"ImplementationIdentifier"},
      "max":1,
      "min":1
    },
    "ImplementationSummary":{
      "type":"structure",
      "required":["Type"],
      "members":{
        "Type":{
          "shape":"ImplementationType",
          "documentation":"<p>A string that represents the Amazon Web Services service that implements this control. For example, a value of <code>AWS::Config::ConfigRule</code> indicates that the control is implemented by Amazon Web Services Config, and <code>AWS::SecurityHub::SecurityControl</code> indicates implementation by Amazon Web Services Security Hub.</p>"
        },
        "Identifier":{
          "shape":"ImplementationIdentifier",
          "documentation":"<p>The identifier originally assigned by the Amazon Web Services service that implements the control. For example, <code>CODEPIPELINE_DEPLOYMENT_COUNT_CHECK</code>.</p>"
        }
      },
      "documentation":"<p>A summary of how the control is implemented, including the Amazon Web Services service that enforces the control and its service-specific identifier. For example, the value of this field could indicate that the control is implemented as an Amazon Web Services Config Rule or an Amazon Web Services Security Hub control.</p>"
    },
    "ImplementationType":{
      "type":"string",
      "max":2048,
      "min":7,
      "pattern":"[A-Za-z0-9]+(::[A-Za-z0-9_]+){2,3}"
    },
    "ImplementationTypeFilterList":{
      "type":"list",
      "member":{"shape":"ImplementationType"},
      "max":1,
      "min":1
    },
    "InternalServerException":{
      "type":"structure",
      "members":{
        "Message":{"shape":"String"}
      },
      "documentation":"<p>An internal service error occurred during the processing of your request. Try again later.</p>",
      "error":{"httpStatusCode":500},
      "exception":true,
      "fault":true,
      "retryable":{"throttling":false}
    },
    "ListCommonControlsRequest":{
      "type":"structure",
      "members":{
        "MaxResults":{
          "shape":"MaxListCommonControlsResults",
          "documentation":"<p>The maximum number of results on a page or for an API request call.</p>",
          "location":"querystring",
          "locationName":"maxResults"
        },
        "NextToken":{
          "shape":"PaginationToken",
          "documentation":"<p>The pagination token that's used to fetch the next set of results.</p>",
          "location":"querystring",
          "locationName":"nextToken"
        },
        "CommonControlFilter":{
          "shape":"CommonControlFilter",
          "documentation":"<p>An optional filter that narrows the results to a specific objective.</p> <p>This filter allows you to specify one objective ARN at a time. Passing multiple ARNs in the <code>CommonControlFilter</code> isn’t supported.</p>"
        }
      }
    },
    "ListCommonControlsResponse":{
      "type":"structure",
      "required":["CommonControls"],
      "members":{
        "CommonControls":{
          "shape":"CommonControlSummaryList",
          "documentation":"<p>The list of common controls that the <code>ListCommonControls</code> API returns.</p>"
        },
        "NextToken":{
          "shape":"PaginationToken",
          "documentation":"<p>The pagination token that's used to fetch the next set of results.</p>"
        }
      }
    },
    "ListControlMappingsRequest":{
      "type":"structure",
      "members":{
        "NextToken":{
          "shape":"PaginationToken",
          "documentation":"<p>The pagination token that's used to fetch the next set of results.</p>",
          "location":"querystring",
          "locationName":"nextToken"
        },
        "MaxResults":{
          "shape":"MaxListControlMappingsResults",
          "documentation":"<p>The maximum number of results on a page or for an API request call.</p>",
          "location":"querystring",
          "locationName":"maxResults"
        },
        "Filter":{
          "shape":"ControlMappingFilter",
          "documentation":"<p>An optional filter that narrows the results to specific control mappings based on control ARNs, common control ARNs, or mapping types.</p>"
        }
      }
    },
    "ListControlMappingsResponse":{
      "type":"structure",
      "required":["ControlMappings"],
      "members":{
        "ControlMappings":{
          "shape":"ControlMappings",
          "documentation":"<p>The list of control mappings that the ListControlMappings API returns.</p>"
        },
        "NextToken":{
          "shape":"PaginationToken",
          "documentation":"<p>The pagination token that's used to fetch the next set of results.</p>"
        }
      }
    },
    "ListControlsRequest":{
      "type":"structure",
      "members":{
        "NextToken":{
          "shape":"PaginationToken",
          "documentation":"<p>The pagination token that's used to fetch the next set of results.</p>",
          "location":"querystring",
          "locationName":"nextToken"
        },
        "MaxResults":{
          "shape":"MaxListControlsResults",
          "documentation":"<p>The maximum number of results on a page or for an API request call.</p>",
          "location":"querystring",
          "locationName":"maxResults"
        },
        "Filter":{
          "shape":"ControlFilter",
          "documentation":"<p>An optional filter that narrows the results to controls with specific implementation types or identifiers. If you don't provide a filter, the operation returns all available controls.</p>"
        }
      }
    },
    "ListControlsResponse":{
      "type":"structure",
      "required":["Controls"],
      "members":{
        "Controls":{
          "shape":"Controls",
          "documentation":"<p>Returns a list of controls, given as structures of type <i>controlSummary</i>.</p>"
        },
        "NextToken":{
          "shape":"PaginationToken",
          "documentation":"<p>The pagination token that's used to fetch the next set of results.</p>"
        }
      }
    },
    "ListDomainsRequest":{
      "type":"structure",
      "members":{
        "MaxResults":{
          "shape":"MaxListDomainsResults",
          "documentation":"<p>The maximum number of results on a page or for an API request call.</p>",
          "location":"querystring",
          "locationName":"maxResults"
        },
        "NextToken":{
          "shape":"PaginationToken",
          "documentation":"<p>The pagination token that's used to fetch the next set of results.</p>",
          "location":"querystring",
          "locationName":"nextToken"
        }
      }
    },
    "ListDomainsResponse":{
      "type":"structure",
      "required":["Domains"],
      "members":{
        "Domains":{
          "shape":"DomainSummaryList",
          "documentation":"<p>The list of domains that the <code>ListDomains</code> API returns.</p>"
        },
        "NextToken":{
          "shape":"PaginationToken",
          "documentation":"<p>The pagination token that's used to fetch the next set of results.</p>"
        }
      }
    },
    "ListObjectivesRequest":{
      "type":"structure",
      "members":{
        "MaxResults":{
          "shape":"MaxListObjectivesResults",
          "documentation":"<p>The maximum number of results on a page or for an API request call.</p>",
          "location":"querystring",
          "locationName":"maxResults"
        },
        "NextToken":{
          "shape":"PaginationToken",
          "documentation":"<p>The pagination token that's used to fetch the next set of results.</p>",
          "location":"querystring",
          "locationName":"nextToken"
        },
        "ObjectiveFilter":{
          "shape":"ObjectiveFilter",
          "documentation":"<p>An optional filter that narrows the results to a specific domain.</p> <p>This filter allows you to specify one domain ARN at a time. Passing multiple ARNs in the <code>ObjectiveFilter</code> isn’t supported.</p>"
        }
      }
    },
    "ListObjectivesResponse":{
      "type":"structure",
      "required":["Objectives"],
      "members":{
        "Objectives":{
          "shape":"ObjectiveSummaryList",
          "documentation":"<p>The list of objectives that the <code>ListObjectives</code> API returns.</p>"
        },
        "NextToken":{
          "shape":"PaginationToken",
          "documentation":"<p>The pagination token that's used to fetch the next set of results.</p>"
        }
      }
    },
    "Mapping":{
      "type":"structure",
      "members":{
        "Framework":{
          "shape":"FrameworkMappingDetails",
          "documentation":"<p>The framework mapping details when the mapping type relates to a compliance framework.</p>"
        },
        "CommonControl":{
          "shape":"CommonControlMappingDetails",
          "documentation":"<p>The common control mapping details when the mapping type relates to a common control.</p>"
        },
        "RelatedControl":{
          "shape":"RelatedControlMappingDetails",
          "documentation":"<p>Returns information about controls that are related to the specified control.</p>"
        }
      },
      "documentation":"<p>A structure that contains the details of a mapping relationship, which can be either to a framework or to a common control.</p>",
      "union":true
    },
    "MappingType":{
      "type":"string",
      "enum":[
        "FRAMEWORK",
        "COMMON_CONTROL",
        "RELATED_CONTROL"
      ]
    },
    "MappingTypeFilterList":{
      "type":"list",
      "member":{"shape":"MappingType"},
      "max":1,
      "min":1
    },
    "MaxListCommonControlsResults":{
      "type":"integer",
      "box":true,
      "max":100,
      "min":1
    },
    "MaxListControlMappingsResults":{
      "type":"integer",
      "box":true,
      "max":1000,
      "min":1
    },
    "MaxListControlsResults":{
      "type":"integer",
      "box":true,
      "max":100,
      "min":1
    },
    "MaxListDomainsResults":{
      "type":"integer",
      "box":true,
      "max":100,
      "min":1
    },
    "MaxListObjectivesResults":{
      "type":"integer",
      "box":true,
      "max":100,
      "min":1
    },
    "ObjectiveArn":{
      "type":"string",
      "max":2048,
      "min":36,
      "pattern":"arn:(aws(?:[-a-z]*)?):controlcatalog:::objective/[0-9a-z]+"
    },
    "ObjectiveFilter":{
      "type":"structure",
      "members":{
        "Domains":{
          "shape":"DomainResourceFilterList",
          "documentation":"<p>The domain that's used as filter criteria.</p> <p>You can use this parameter to specify one domain ARN at a time. Passing multiple ARNs in the <code>ObjectiveFilter</code> isn’t supported.</p>"
        }
      },
      "documentation":"<p>An optional filter that narrows the list of objectives to a specific domain.</p>"
    },
    "ObjectiveResourceFilter":{
      "type":"structure",
      "members":{
        "Arn":{
          "shape":"ObjectiveArn",
          "documentation":"<p>The Amazon Resource Name (ARN) of the objective.</p>"
        }
      },
      "documentation":"<p>The objective resource that's being used as a filter.</p>"
    },
    "ObjectiveResourceFilterList":{
      "type":"list",
      "member":{"shape":"ObjectiveResourceFilter"}
    },
    "ObjectiveSummary":{
      "type":"structure",
      "required":[
        "Arn",
        "Name",
        "Description",
        "Domain",
        "CreateTime",
        "LastUpdateTime"
      ],
      "members":{
        "Arn":{
          "shape":"ObjectiveArn",
          "documentation":"<p>The Amazon Resource Name (ARN) that identifies the objective.</p>"
        },
        "Name":{
          "shape":"String",
          "documentation":"<p>The name of the objective.</p>"
        },
        "Description":{
          "shape":"String",
          "documentation":"<p>The description of the objective.</p>"
        },
        "Domain":{
          "shape":"AssociatedDomainSummary",
          "documentation":"<p>The domain that the objective belongs to.</p>"
        },
        "CreateTime":{
          "shape":"Timestamp",
          "documentation":"<p>The time when the objective was created.</p>"
        },
        "LastUpdateTime":{
          "shape":"Timestamp",
          "documentation":"<p>The time when the objective was most recently updated.</p>"
        }
      },
      "documentation":"<p>A summary of metadata for an objective.</p>"
    },
    "ObjectiveSummaryList":{
      "type":"list",
      "member":{"shape":"ObjectiveSummary"}
    },
    "PaginationToken":{
      "type":"string",
      "max":1024,
      "min":0
    },
    "ParameterRequirementSummary":{
      "type":"string",
      "enum":[
        "REQUIRED",
        "OPTIONAL",
        "NONE"
      ]
    },
    "RegionCode":{
      "type":"string",
      "pattern":"[a-zA-Z0-9-]{1,128}"
    },
    "RegionConfiguration":{
      "type":"structure",
      "required":["Scope"],
      "members":{
        "Scope":{
          "shape":"ControlScope",
          "documentation":"<p>The coverage of the control, if deployed. Scope is an enumerated type, with value <code>Regional</code>, or <code>Global</code>. A control with Global scope is effective in all Amazon Web Services Regions, regardless of the Region from which it is enabled, or to which it is deployed. A control implemented by an SCP is usually Global in scope. A control with Regional scope has operations that are restricted specifically to the Region from which it is enabled and to which it is deployed. Controls implemented by Config rules and CloudFormation hooks usually are Regional in scope. Security Hub controls usually are Regional in scope.</p>"
        },
        "DeployableRegions":{
          "shape":"DeployableRegions",
          "documentation":"<p>Regions in which the control is available to be deployed.</p>"
        }
      },
      "documentation":"<p>Returns information about the control, including the scope of the control, if enabled, and the Regions in which the control is available for deployment. For more information about scope, see <a href=\"https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html\">Global services</a>.</p> <p>If you are applying controls through an Amazon Web Services Control Tower landing zone environment, remember that the values returned in the <code>RegionConfiguration</code> API operation are not related to the governed Regions in your landing zone. For example, if you are governing Regions <code>A</code>,<code>B</code>,and <code>C</code> while the control is available in Regions <code>A</code>, <code>B</code>, C<code>,</code> and <code>D</code>, you'd see a response with <code>DeployableRegions</code> of <code>A</code>, <code>B</code>, <code>C</code>, and <code>D</code> for a control with <code>REGIONAL</code> scope, even though you may not intend to deploy the control in Region <code>D</code>, because you do not govern it through your landing zone.</p>"
    },
    "RelatedControlMappingDetails":{
      "type":"structure",
      "required":["RelationType"],
      "members":{
        "ControlArn":{
          "shape":"ControlArn",
          "documentation":"<p>The unique identifier of a control.</p>"
        },
        "RelationType":{
          "shape":"ControlRelationType",
          "documentation":"<p>Returns an enumerated value that represents the relationship between two or more controls.</p>"
        }
      },
      "documentation":"<p>A structure that describes a control's relationship status with other controls.</p>"
    },
    "ResourceNotFoundException":{
      "type":"structure",
      "members":{
        "Message":{"shape":"String"}
      },
      "documentation":"<p>The requested resource does not exist.</p>",
      "error":{
        "httpStatusCode":404,
        "senderFault":true
      },
      "exception":true
    },
    "String":{"type":"string"},
    "ThrottlingException":{
      "type":"structure",
      "members":{
        "Message":{"shape":"String"}
      },
      "documentation":"<p>The request was denied due to request throttling.</p>",
      "error":{
        "httpStatusCode":429,
        "senderFault":true
      },
      "exception":true,
      "retryable":{"throttling":true}
    },
    "Timestamp":{"type":"timestamp"},
    "ValidationException":{
      "type":"structure",
      "members":{
        "Message":{"shape":"String"}
      },
      "documentation":"<p>The request has invalid or missing parameters.</p>",
      "error":{
        "httpStatusCode":400,
        "senderFault":true
      },
      "exception":true
    }
  },
  "documentation":"<p>Welcome to the Control Catalog API reference. This guide is for developers who need detailed information about how to programmatically identify and filter the common controls and related metadata that are available to Amazon Web Services customers. This API reference provides descriptions, syntax, and usage examples for each of the actions and data types that are supported by Control Catalog. </p> <p>Use the following links to get started with the Control Catalog API:</p> <ul> <li> <p> <a href=\"https://docs.aws.amazon.com/controlcatalog/latest/APIReference/API_Operations.html\">Actions</a>: An alphabetical list of all Control Catalog API operations.</p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/controlcatalog/latest/APIReference/API_Types.html\">Data types</a>: An alphabetical list of all Control Catalog data types.</p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/controlcatalog/latest/APIReference/CommonParameters.html\">Common parameters</a>: Parameters that all operations can use.</p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/controlcatalog/latest/APIReference/CommonErrors.html\">Common errors</a>: Client and server errors that all operations can return.</p> </li> </ul>"
}
