| controltower:CreateLandingZone | Admin |
| controltower:CreateManagedAccount | Admin |
| controltower:DeleteLandingZone | Admin |
| controltower:DeregisterManagedAccount | Admin |
| controltower:DeregisterOrganizationalUnit | Admin |
| controltower:DisableBaseline | Admin |
| controltower:DisableControl | Admin |
| controltower:DisableGuardrail | Admin |
| controltower:EnableBaseline | Admin |
| controltower:EnableControl | Admin |
| controltower:EnableGuardrail | Admin |
| controltower:ManageOrganizationalUnit | Admin |
| controltower:ResetEnabledBaseline | Admin |
| controltower:ResetEnabledControl | Admin |
| controltower:ResetLandingZone | Admin |
| controltower:SetupLandingZone | Admin |
| controltower:UpdateAccountFactoryConfig | Admin |
| controltower:UpdateEnabledBaseline | Admin |
| controltower:UpdateEnabledControl | Admin |
| controltower:UpdateLandingZone | Admin |
| controltower:TagResource | Operator |
| controltower:UntagResource | Operator |
| controlcatalog:GetControl | Metadata |
| controlcatalog:ListCommonControls | Metadata |
| controlcatalog:ListControlMappings | Metadata |
| controlcatalog:ListControls | Metadata |
| controlcatalog:ListDomains | Metadata |
| controlcatalog:ListObjectives | Metadata |
| controltower:DescribeAccountFactoryConfig | Metadata |
| controltower:DescribeCoreService | Metadata |
| controltower:DescribeGuardrail | Metadata |
| controltower:DescribeGuardrailForTarget | Metadata |
| controltower:DescribeLandingZoneConfiguration | Metadata |
| controltower:DescribeManagedAccount | Metadata |
| controltower:DescribeManagedOrganizationalUnit | Metadata |
| controltower:DescribeRegisterOrganizationalUnitOperation | Metadata |
| controltower:DescribeSingleSignOn | Metadata |
| controltower:GetAccountInfo | Metadata |
| controltower:GetAvailableUpdates | Metadata |
| controltower:GetBaseline | Metadata |
| controltower:GetBaselineOperation | Metadata |
| controltower:GetControlOperation | Metadata |
| controltower:GetEnabledBaseline | Metadata |
| controltower:GetEnabledControl | Metadata |
| controltower:GetGuardrailComplianceStatus | Metadata |
| controltower:GetHomeRegion | Metadata |
| controltower:GetLandingZone | Metadata |
| controltower:GetLandingZoneDriftStatus | Metadata |
| controltower:GetLandingZoneOperation | Metadata |
| controltower:GetLandingZoneStatus | Metadata |
| controltower:ListBaselines | Metadata |
| controltower:ListControlOperations | Metadata |
| controltower:ListDirectoryGroups | Metadata |
| controltower:ListDriftDetails | Metadata |
| controltower:ListEnabledBaselines | Metadata |
| controltower:ListEnabledControls | Metadata |
| controltower:ListEnabledGuardrails | Metadata |
| controltower:ListExtendGovernancePrecheckDetails | Metadata |
| controltower:ListExternalConfigRuleCompliance | Metadata |
| controltower:ListGuardrailViolations | Metadata |
| controltower:ListGuardrails | Metadata |
| controltower:ListGuardrailsForTarget | Metadata |
| controltower:ListLandingZoneOperations | Metadata |
| controltower:ListLandingZones | Metadata |
| controltower:ListManagedAccounts | Metadata |
| controltower:ListManagedAccountsForGuardrail | Metadata |
| controltower:ListManagedAccountsForParent | Metadata |
| controltower:ListManagedOrganizationalUnits | Metadata |
| controltower:ListManagedOrganizationalUnitsForGuardrail | Metadata |
| controltower:ListTagsForResource | Metadata |
| controltower:PerformPreLaunchChecks | Metadata |
