Controlcatalog Diagnostics

AWS Control Catalog Diagnostics

When to use

Any AWS Control Catalog investigation — control listing, control detail retrieval, objective mapping, common control identification, regional availability, or API usage issues.

Investigation workflow

Step 1 — Collect and triage

aws controlcatalog list-controls --query 'controls[*].{Arn:arn,Name:name}'
version: "1.0.0"
last_updated: "2025-04-12"
aws controlcatalog list-objectives --query 'objectives[*].{Arn:arn,Name:name}'
version: "1.0.0"
last_updated: "2025-04-12"
aws controlcatalog list-domains --query 'domains[*].{Arn:arn,Name:name}'
version: "1.0.0"
last_updated: "2025-04-12"

Step 2 — Domain deep dive

aws controlcatalog get-control --control-arn <arn>
aws controlcatalog list-common-controls --common-control-filter '{"objectives":[{"arn":"<objective-arn>"}]}'

Step 3 — Detailed investigation

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=controlcatalog.amazonaws.com --max-results 20
aws controltower list-enabled-controls --target-identifier <ou-arn>

Read references/guardrails.md before concluding on any Control Catalog issue.

Tool quick reference

Gotchas: AWS Control Catalog

• Control Catalog is a READ-ONLY service. It provides information about available controls but does NOT enable or enforce them. Use Control Tower or other services to enable controls.
• Controls in the catalog are organized by domains and objectives. Domains are broad categories, objectives are specific goals within domains.
• Common controls are AWS-recommended controls that map to multiple compliance frameworks. They are not custom controls.
• Control Catalog is a relatively new service. Not all controls from all services may be listed. The catalog is continuously expanding.
• Regional availability varies. Some controls are only available in specific regions. Check control details for regional support.
• Control Catalog API is separate from Control Tower API. Listing controls in the catalog doesn't mean they're enabled in your environment.

Anti-hallucination rules

1. Always cite specific control ARNs, names, or API responses as evidence.
2. Control Catalog is READ-ONLY. Never suggest it enables or enforces controls.
3. Common controls are AWS-defined. Never suggest creating custom common controls.
4. Not all controls are in the catalog. Never assume comprehensive coverage.
5. Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.

12 runbooks